CVE-2026-63379

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63379
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63379.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63379
Aliases
  • GHSA-2gmv-p5m7-98p6
Downstream
Published
2026-08-20T17:55:00.789Z
Modified
2026-08-22T09:15:55.565945Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Libevent: HTTP Header smuggling
Details

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-444"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63379.json"
}
References

Affected packages

Git / github.com/libevent/libevent

Affected ranges

Type
GIT
Repo
https://github.com/libevent/libevent
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
79ddfb460847999b807cba76d04e73891f29c6ee
Fixed
df3ecad3a040fd6d4fad4287defe113395de6fd7
Fixed
87e8e44fa774e9677b089b1a5114ee68aefa1636
Fixed
b847071141b3827900d536594ec9045eb0a4c485
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.13"
        },
        {
            "introduced": "2.2.0-alpha"
        },
        {
            "fixed": "2.2.2-alpha"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

release-1.*
release-1.1b
release-2.*
release-2.0.1-alpha
release-2.0.10-stable
release-2.0.3-alpha
release-2.0.4-alpha
release-2.0.5-beta
release-2.0.6-rc
release-2.0.7-rc
release-2.0.8-rc
release-2.0.9-rc
release-2.1.1-alpha
release-2.1.10-stable
release-2.1.11-stable
release-2.1.12-stable
release-2.1.2-alpha
release-2.1.3-alpha
release-2.1.4-alpha
release-2.1.5-beta
release-2.1.6-beta
release-2.1.7-rc
release-2.1.8-stable
release-2.1.9-beta
release-2.2.1-alpha

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63379.json"
vanir_signatures 
[
    {
        "target": {
            "function": "http_check_transfer_encoding_test",
            "file": "test/regress_http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7",
        "id": "CVE-2026-63379-09212634",
        "signature_version": "v1",
        "digest": {
            "length": 554.0,
            "function_hash": "159443554126248192493229143747497657830"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "evhttp_parse_headers_",
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636",
        "id": "CVE-2026-63379-22a71ff7",
        "signature_version": "v1",
        "digest": {
            "length": 1078.0,
            "function_hash": "239504701231416308484423487682461223518"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "evhttp_read_trailer",
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636",
        "id": "CVE-2026-63379-27eb3b71",
        "signature_version": "v1",
        "digest": {
            "length": 400.0,
            "function_hash": "9779685853636844600237555984948255248"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636",
        "id": "CVE-2026-63379-28ecf218",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "65111243531268974160005605360168170935",
                "107620246626032186158942398086015465687",
                "69869366833060082186002060033350453026",
                "55259272766720684467672970472695269898",
                "234603135147329347214211908465286217700",
                "78730403153954306194617078068637848293",
                "80237498898681536292115697206606056770",
                "240443224918776039178248009011788522320",
                "59143161919021300068775172641979361755",
                "176906661887520979065380937045951660796",
                "163365333947463192760216260292028193514",
                "168796573672783060897495388077642159493",
                "127667215342036913072137726559158981757",
                "187348593281087902192458226295844241873",
                "86806918437872607352809874018987564456",
                "79257392173898998873557695382809743988",
                "77512930519195976976646711584088059470",
                "85624624188710027250081749540922243152",
                "239905070383706960393275708850418194014",
                "272698428298809456881166400176874945890",
                "217589744529312143789544007237481523776",
                "139972510930712699336452955734570707814",
                "50787474251233255544722177200512141142",
                "25561295225117548668558692988639291720",
                "291054240583102250515045063880116613532",
                "208920865826417499957446877419600210938",
                "120360035151430792179527738819835803987",
                "55471229886145665608233624668390955870",
                "244296681046564776749629984391425551630"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "evhttp_read_trailer",
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485",
        "id": "CVE-2026-63379-73ab94e9",
        "signature_version": "v1",
        "digest": {
            "length": 400.0,
            "function_hash": "9779685853636844600237555984948255248"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "evhttp_parse_headers_",
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485",
        "id": "CVE-2026-63379-7c0a301a",
        "signature_version": "v1",
        "digest": {
            "length": 1078.0,
            "function_hash": "239504701231416308484423487682461223518"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "test/regress_http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7",
        "id": "CVE-2026-63379-923050c6",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "270762094980121927552802584929566056086",
                "37564212311334647331345684303177453724",
                "168570413533780985513641597969239978857"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "test/regress_http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee",
        "id": "CVE-2026-63379-979e5bed",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "270762094980121927552802584929566056086",
                "37564212311334647331345684303177453724",
                "168570413533780985513641597969239978857"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485",
        "id": "CVE-2026-63379-bd70cf62",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "121866999892246749841477517448919568061",
                "218940061900138967527574999999031688584",
                "46040490677877218218042447030091681825",
                "67710350957676641751739359323947755555",
                "234603135147329347214211908465286217700",
                "78730403153954306194617078068637848293",
                "80237498898681536292115697206606056770",
                "240443224918776039178248009011788522320",
                "59143161919021300068775172641979361755",
                "176906661887520979065380937045951660796",
                "163365333947463192760216260292028193514",
                "168796573672783060897495388077642159493",
                "127667215342036913072137726559158981757",
                "187348593281087902192458226295844241873",
                "86806918437872607352809874018987564456",
                "79257392173898998873557695382809743988",
                "77512930519195976976646711584088059470",
                "85624624188710027250081749540922243152",
                "239905070383706960393275708850418194014",
                "272698428298809456881166400176874945890",
                "217589744529312143789544007237481523776",
                "139972510930712699336452955734570707814",
                "50787474251233255544722177200512141142",
                "25561295225117548668558692988639291720",
                "291054240583102250515045063880116613532",
                "208920865826417499957446877419600210938",
                "120360035151430792179527738819835803987",
                "55471229886145665608233624668390955870",
                "244296681046564776749629984391425551630"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "http_check_transfer_encoding_test",
            "file": "test/regress_http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee",
        "id": "CVE-2026-63379-ebc5ab94",
        "signature_version": "v1",
        "digest": {
            "length": 554.0,
            "function_hash": "159443554126248192493229143747497657830"
        },
        "signature_type": "Function"
    }
]
vanir_signatures_modified 
"2026-08-22T09:15:55Z"