p PatchFirst

CVE-2026-63382

CVE-2026-63382 · libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

CVSS 9.2 · Critical · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • libevent

    Versions
    • >= 2.2.0-alpha, < 2.2.2-alpha: Affected
    • < 2.1.13: Affected

    No fix published

  • libevent Debian:12

    Versions
    • 2.1.12-stable-8
    Affected ranges
    • ECOSYSTEM: < 2.1.12-stable-8+deb12u1

    Update to 2.1.12-stable-8+deb12u1

  • libevent Debian:13

    Versions
    • 2.1.12-stable-10
    Affected ranges
    • ECOSYSTEM: < 2.1.13-stable-1~deb13u1

    Update to 2.1.13-stable-1~deb13u1

  • libevent Debian:14

    Versions
    • 2.1.12-stable-10
    • 2.1.13-stable-1~deb13u1
    Affected ranges
    • ECOSYSTEM: < 2.1.13-stable-1

    Update to 2.1.13-stable-1

  • libevent Ubuntu:Pro:14.04:LTS

    Versions
    • 2.0.21-stable-1
    • 2.0.21-stable-1ubuntu1
    • 2.0.21-stable-1ubuntu1.14.04.1
    • 2.0.21-stable-1ubuntu1.14.04.2
    Affected ranges
    • ECOSYSTEM: < 2.0.21-stable-1ubuntu1.14.04.2+esm1

    Update to 2.0.21-stable-1ubuntu1.14.04.2+esm1

  • libevent Ubuntu:Pro:16.04:LTS

    Versions
    • 2.0.21-stable-2
    • 2.0.21-stable-2ubuntu0.16.04.1
    Affected ranges
    • ECOSYSTEM: < 2.0.21-stable-2ubuntu0.16.04.1+esm1

    Update to 2.0.21-stable-2ubuntu0.16.04.1+esm1

  • libevent Ubuntu:Pro:18.04:LTS

    Versions
    • 2.1.8-stable-4
    • 2.1.8-stable-4build1
    Affected ranges
    • ECOSYSTEM: < 2.1.8-stable-4ubuntu0.1~esm1

    Update to 2.1.8-stable-4ubuntu0.1~esm1

  • libevent Ubuntu:Pro:20.04:LTS

    Versions
    • 2.1.8-stable-4build1
    • 2.1.11-stable-1~exp0
    • 2.1.11-stable-1
    Affected ranges
    • ECOSYSTEM: < 2.1.11-stable-1ubuntu0.1~esm1

    Update to 2.1.11-stable-1ubuntu0.1~esm1

  • libevent Ubuntu:22.04:LTS

    Versions
    • 2.1.12-stable-1
    • 2.1.12-stable-1build1
    • 2.1.12-stable-1build2
    • 2.1.12-stable-1build3
    Affected ranges
    • ECOSYSTEM: < 2.1.12-stable-1ubuntu0.1

    Update to 2.1.12-stable-1ubuntu0.1

  • libevent Ubuntu:24.04:LTS

    Versions
    • 2.1.12-stable-9
    • 2.1.12-stable-9ubuntu2
    Affected ranges
    • ECOSYSTEM: < 2.1.12-stable-9ubuntu2.1

    Update to 2.1.12-stable-9ubuntu2.1

  • libevent Ubuntu:26.04:LTS

    Versions
    • 2.1.12-stable-10build1
    • 2.1.12-stable-10build2
    Affected ranges
    • ECOSYSTEM: < 2.1.12-stable-10ubuntu0.1

    Update to 2.1.12-stable-10ubuntu0.1

Original sources

Check your server →