libevent EUVD-2026-63562

Exploitation requires an upstream reverse proxy (nginx, HAProxy, Varnish, Apache httpd in proxy mode, or similar) that forwards HTTP/1.1 chunked requests to a libevent-based backend without stripping or normalizing chunked trailers. The libevent application must perform security-relevant decisions - authorization enforcement, IP-based allowlisting, cache keying, or routing - based on HTTP header values. Without the proxy intermediary, a direct client-to-libevent connection offers no meaningful smuggling advantage because the attacker already controls all headers at the request level. Exploitation is further limited by the proxy's own trailer-handling behavior: proxies that normalize or reject chunked trailers before forwarding neutralize the attack. No authentication is required (PR:N) and no user interaction is needed.

The CVSS 4.0 score of 6.3 with AT:P correctly represents that exploitation is conditioned on a specific deployment topology: an upstream reverse proxy must forward chunked HTTP/1.1 requests to a libevent-based backend without stripping trailers, and the application must perform security-relevant decisions based on header values. Without this intermediary, an attacker controlling the direct connection gains no practical advantage from trailer injection. The AT:P qualifier meaningfully reduces the exploitable population relative to a raw AV:N/AC:L scenario. This CVE is not listed in the CISA KEV catalog based on available data, and no POC exploit code was identified in the provided intelligence. EPSS data was not supplied. The impact is bounded to confidentiality and integrity at low severity - authorization bypass and header spoofing rather than code execution - making this a meaningful but non-catastrophic vulnerability. Organizations using libevent-based HTTP servers behind proxies that enforce authorization via headers should treat this as a genuine remediation priority; those with direct client-to-server deployments or proxies that strip chunked trailers face materially lower real-world risk.

An attacker sends a crafted HTTP/1.1 request with chunked transfer encoding to a reverse proxy fronting a libevent-based backend, embedding a spoofed Authorization header as a chunked trailer after the zero-length terminal chunk. The proxy evaluates the original (absent) Authorization header, finds no credentials, but forwards the chunked body including the trailer to libevent. libevent's pre-fix evhttp_read_trailer merges the trailer into req->input_headers, and the application logic reads the attacker-supplied Authorization value as if the proxy had forwarded it, granting unauthorized access. No public exploit code has been identified at time of analysis, but the attack concept is well-documented in the HTTP request smuggling literature.