Skip to main content

libevent CVE-2026-63382

| EUVDEUVD-2026-63505 CRITICAL
HTTP Request/Response Smuggling (CWE-444)
2026-08-20 GitHub_M
Request Smuggling Authentication Bypass Libevent Suse
9.2
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.9 HIGH

Network, unauthenticated (PR:N/UI:N), but AC:H because exploitation needs a differently-framing proxy; S:C as smuggling crosses the proxy trust boundary, with high C/I and low A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N
SUSE
7.7 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 20, 2026 - 18:28 vuln.today
Analysis Generated
Aug 20, 2026 - 18:28 vuln.today
Patch available
Aug 20, 2026 - 18:03 EUVD
CVE Published
Aug 20, 2026 - 17:51 cve.org
CRITICAL 9.2

DescriptionCVE.org

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

AnalysisAI

HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha line prior to 2.2.2-alpha, letting an unauthenticated remote attacker desynchronize request boundaries when libevent sits behind a differently-framing proxy. Because evhttp mishandles duplicate and comma-listed Transfer-Encoding headers and accepts bare-LF chunk terminators, a smuggled second request can bypass proxy-enforced access controls or poison shared caches. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target run the libevent evhttp HTTP server behind an intermediary (reverse proxy, load balancer, or CDN) whose HTTP framing differs from libevent's - this is the AT:P Attack Requirement and the core prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 base score is 9.2 (Critical) with AV:N/AC:L/AT:P/PR:N/UI:N and high confidentiality and integrity impact - reflecting unauthenticated network reach but an Attack Requirement (AT:P): the desync only manifests when libevent evhttp runs behind a proxy that frames the same request differently, so exploitability is real but conditional rather than universal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade to libevent 2.1.13 (stable, https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable) or, for the alpha line, 2.2.2-alpha (https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha); the fixes are in commits 10abb34b, 5119ceb0, 83ba6737, and ac38703b, which add evhttp_check_transfer_encoding_, correctly handle duplicate and comma-separated Transfer-Encoding values, and switch chunk parsing to EVBUFFER_EOL_CRLF_STRICT to reject bare-LF terminators. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Begin with a 24-hour inventory of all libevent installations, focusing on versions prior to 2.1.13 or any 2.2.x-alpha before 2.2.2-alpha, and identify which run behind proxies or handle sensitive data. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libevent

View all
CVE-2016-10195 CRITICAL POC
9.8 Mar 15

The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via

CVE-2016-10197 HIGH POC
7.5 Mar 15

The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out
CVE-2016-10196 HIGH POC
7.5 Mar 15

Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows

CVE-2026-63384 HIGH
8.7 Aug 20

Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of s
CVE-2026-63383 HIGH
8.7 Aug 20

Out-of-bounds read in libevent's tagged RPC decoder crashes any application that decodes attacker-controlled tag data us
CVE-2026-63388 HIGH
8.4 Aug 20

Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener
CVE-2014-6272 HIGH
7.5 Aug 24

Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.
CVE-2015-6525 HIGH
7.5 Aug 24

Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context
CVE-2026-63495 HIGH
7.5 Aug 20

Memory exhaustion in libevent's WebSocket server (ws.c) allows unauthenticated remote clients to crash affected processe
CVE-2026-63387 HIGH
7.0 Aug 20

Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables
CVE-2026-63381 MEDIUM
5.8 Aug 20

Use-after-free memory corruption in libevent's evbuffer_add_buffer_reference (buffer.c) allows a caller that can drive a
CVE-2026-63380 MEDIUM
5.7 Aug 20

Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privi

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8

Same technique Request Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8
CVE-2020-10108 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-63382 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy