libevent CVE-2026-63382

Exploitation requires that the target run the libevent evhttp HTTP server behind an intermediary (reverse proxy, load balancer, or CDN) whose HTTP framing differs from libevent's - this is the AT:P Attack Requirement and the core prerequisite. The attacker crafts requests using at least one of the three vulnerable behaviors: duplicate Transfer-Encoding headers (only the first is read), a comma-separated Transfer-Encoding list ending in 'chunked' (formerly unrecognized), or bare-LF-terminated chunk lines (formerly accepted). No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: standalone libevent evhttp with no fronting proxy, or a proxy that already strictly normalizes Transfer-Encoding and chunk framing, largely neutralizes the desync; the flaw is inapplicable to deployments that do not use the evhttp module at all.

The vendor CVSS 4.0 base score is 9.2 (Critical) with AV:N/AC:L/AT:P/PR:N/UI:N and high confidentiality and integrity impact - reflecting unauthenticated network reach but an Attack Requirement (AT:P): the desync only manifests when libevent evhttp runs behind a proxy that frames the same request differently, so exploitability is real but conditional rather than universal. That AT:P is the single most important signal: this is not a default-config, standalone-server bug, which tempers the raw 9.2. There is no CISA KEV listing and no evidence of a public POC, so exploitation status is theoretical at present, but request-smuggling classes are well understood and readily reproduced by skilled attackers once a vulnerable proxy/back-end pairing is known. Given libevent's broad embedding, defenders running evhttp behind CDNs, load balancers, or reverse proxies should treat this as a high-priority patch even though EPSS/KEV signals are absent; conversely, deployments that do not use evhttp, or use it without a fronting proxy, carry substantially lower real-world risk.

An attacker sends a single crafted HTTP request through a reverse proxy or CDN to a back-end built on libevent evhttp, using duplicate or comma-separated Transfer-Encoding headers and bare-LF chunk delimiters so the proxy and back-end disagree on request boundaries. The trailing bytes are interpreted by libevent as a separate, smuggled request that rides on a victim's connection, letting the attacker bypass proxy access controls or inject a poisoned response into a shared cache. No public exploit is known, but the low attack complexity of the parsing divergence makes reliable exploitation feasible against a suitable proxy pairing.