Skip to main content

libevent CVE-2026-63385

| EUVDEUVD-2026-63563 CRITICAL
HTTP Request/Response Smuggling (CWE-444)
2026-08-20 security-advisories@github.com
Request Smuggling Authentication Bypass Suse
9.2
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.7 HIGH

Network and unauthenticated (AV:N/PR:N) but AC:H because it needs a proxy whose parsing diverges; S:C as the impact crosses into a separate backend, with high confidentiality/integrity from access bypass and smuggling.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
SUSE
7.7 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Patch available
Aug 20, 2026 - 19:03 EUVD
Source Code Evidence Fetched
Aug 20, 2026 - 18:36 vuln.today
Analysis Generated
Aug 20, 2026 - 18:36 vuln.today
CVE Published
Aug 20, 2026 - 18:16 cve.org
CRITICAL 9.2

DescriptionCVE.org

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.

AnalysisAI

HTTP request smuggling and header injection in libevent's http.c allow remote unauthenticated attackers to desynchronize an upstream proxy from libevent's own parsing, bypassing access controls. Affected are all versions prior to 2.1.13-stable and 2.2.2-alpha, where evhttp_header_is_valid_value accepted obsolete CRLF line folding in header values and evhttp_decode_uri_internal decoded %00 into literal NUL bytes that truncate paths in downstream C string operations. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires libevent's evhttp HTTP server or client to be deployed behind (or in front of) a separate HTTP intermediary - a proxy, load balancer, or WAF - whose header/URI parsing differs from libevent's; the CVSS AT:P flag reflects this required parser-discrepancy prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 vector (9.2, AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L) rates this critical, but the AT:P (Attack Requirements: Present) flag is the key qualifier - successful smuggling depends on a specific upstream proxy whose parsing diverges from libevent's, so this is not a universal one-shot RCE. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade libevent to the vendor-released patched versions 2.1.13-stable (https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable) or 2.2.2-alpha (https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha), per advisory GHSA-jcwh-pvf2-73p2; applications that bundle libevent must rebuild and redistribute. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Immediately upon discovery (within 24 hours), audit your infrastructure to identify all applications, web servers, proxies, and appliances using libevent versions prior to 2.1.13-stable and 2.2.2-alpha; document affected systems and their network exposure; and enable enhanced HTTP request logging and alerting on all edge proxies. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-444 – HTTP Request/Response Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8

Same technique Request Smuggling

View all
CVE-2023-41265 CRITICAL POC
9.9
CVE-2026-48710 MEDIUM POC
6.5
CVE-2021-33037 MEDIUM
5.3
CVE-2018-3907 CRITICAL POC
10.0
CVE-2024-10264 CRITICAL POC
9.8
CVE-2022-2466 CRITICAL POC
9.8
CVE-2020-7611 CRITICAL POC
9.8
CVE-2020-10109 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-63385 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy