p PatchFirst

CVE-2026-63382

CVE-2026-63382 · libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

CVSS 9.2 · Crítica · EPSS 0,8% · Corrección disponible

Publicación
Actualización

Pila tecnológica: system

Productos y versiones afectados

  • libevent

    Versiones
    • >= 2.2.0-alpha, < 2.2.2-alpha: Afectada
    • < 2.1.13: Afectada

    Sin corrección publicada

  • libevent Debian:12

    Versiones
    • 2.1.12-stable-8
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.1.12-stable-8+deb12u1

    Actualiza a 2.1.12-stable-8+deb12u1

  • libevent Debian:13

    Versiones
    • 2.1.12-stable-10
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.1.13-stable-1~deb13u1

    Actualiza a 2.1.13-stable-1~deb13u1

  • libevent Debian:14

    Versiones
    • 2.1.12-stable-10
    • 2.1.13-stable-1~deb13u1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.1.13-stable-1

    Actualiza a 2.1.13-stable-1

  • libevent Ubuntu:Pro:14.04:LTS

    Versiones
    • 2.0.21-stable-1
    • 2.0.21-stable-1ubuntu1
    • 2.0.21-stable-1ubuntu1.14.04.1
    • 2.0.21-stable-1ubuntu1.14.04.2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.0.21-stable-1ubuntu1.14.04.2+esm1

    Actualiza a 2.0.21-stable-1ubuntu1.14.04.2+esm1

  • libevent Ubuntu:Pro:16.04:LTS

    Versiones
    • 2.0.21-stable-2
    • 2.0.21-stable-2ubuntu0.16.04.1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.0.21-stable-2ubuntu0.16.04.1+esm1

    Actualiza a 2.0.21-stable-2ubuntu0.16.04.1+esm1

  • libevent Ubuntu:Pro:18.04:LTS

    Versiones
    • 2.1.8-stable-4
    • 2.1.8-stable-4build1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.1.8-stable-4ubuntu0.1~esm1

    Actualiza a 2.1.8-stable-4ubuntu0.1~esm1

  • libevent Ubuntu:Pro:20.04:LTS

    Versiones
    • 2.1.8-stable-4build1
    • 2.1.11-stable-1~exp0
    • 2.1.11-stable-1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.1.11-stable-1ubuntu0.1~esm1

    Actualiza a 2.1.11-stable-1ubuntu0.1~esm1

  • libevent Ubuntu:22.04:LTS

    Versiones
    • 2.1.12-stable-1
    • 2.1.12-stable-1build1
    • 2.1.12-stable-1build2
    • 2.1.12-stable-1build3
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.1.12-stable-1ubuntu0.1

    Actualiza a 2.1.12-stable-1ubuntu0.1

  • libevent Ubuntu:24.04:LTS

    Versiones
    • 2.1.12-stable-9
    • 2.1.12-stable-9ubuntu2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.1.12-stable-9ubuntu2.1

    Actualiza a 2.1.12-stable-9ubuntu2.1

  • libevent Ubuntu:26.04:LTS

    Versiones
    • 2.1.12-stable-10build1
    • 2.1.12-stable-10build2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 2.1.12-stable-10ubuntu0.1

    Actualiza a 2.1.12-stable-10ubuntu0.1

Fuentes originales

Comprueba tu servidor →