libevent CVE-2026-63385

Exploitation requires libevent's evhttp HTTP server or client to be deployed behind (or in front of) a separate HTTP intermediary - a proxy, load balancer, or WAF - whose header/URI parsing differs from libevent's; the CVSS AT:P flag reflects this required parser-discrepancy prerequisite. Concretely, the CRLF vector needs the intermediary to accept obsolete line folding (CR/LF in header values) that libevent previously also accepted, and the URI vector needs a validation step that inspects a different representation of the path than the NUL-truncated string libevent ultimately uses. Limiting factors: no authentication is required (PR:N) and no user interaction (UI:N), but a standalone libevent HTTP endpoint with no divergent intermediary is not exploitable for smuggling, and the impact depends on what access-control or routing logic relies on the differing interpretation.

The supplied CVSS 4.0 vector (9.2, AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L) rates this critical, but the AT:P (Attack Requirements: Present) flag is the key qualifier - successful smuggling depends on a specific upstream proxy whose parsing diverges from libevent's, so this is not a universal one-shot RCE. No EPSS score, KEV listing, or POC was provided: no public exploit identified at time of analysis, and there is no evidence of active exploitation, so the score reflects potential impact rather than demonstrated mass exploitability. A significant caveat: the description explicitly states the reviewed patches fix the CRLF acceptance but do NOT clearly remediate the URI %00 NUL-truncation condition, so upgrading may only close one of the two weaknesses - verify the URI decoding behavior with the vendor advisory. Real-world priority is elevated by libevent's broad embedding but tempered by the proxy-interaction requirement and absence of exploitation signals.

An attacker sends a single crafted HTTP request through a fronting proxy that treats obs-fold or an embedded %00 differently than libevent does; the proxy authorizes or routes based on one interpretation while libevent acts on another, smuggling a hidden request or a truncated path past access-control checks. For example, a path like /public/admin%00.html may pass a proxy allowlist yet be truncated to /public/admin by libevent's NUL-terminated string handling. No POC is provided, and the AT:P requirement means the attacker needs a proxy/backend pair whose parsers actually diverge.