CVE-2026-63382

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63382
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63382.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63382
Aliases
  • GHSA-q39v-w2g7-gr8j
Downstream
Published
2026-08-20T17:51:15.156Z
Modified
2026-08-22T09:15:56.310145Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N CVSS Calculator
Summary
libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling
Details

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first header, evhttpchecktransferencoding was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttphandlechunkedread uses EVBUFFEREOLCRLF rather than EVBUFFEREOLCRLFSTRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-444"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63382.json"
}
References

Affected packages

Git / github.com/libevent/libevent

Affected ranges

Type
GIT
Repo
https://github.com/libevent/libevent
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
df3ecad3a040fd6d4fad4287defe113395de6fd7
Fixed
79ddfb460847999b807cba76d04e73891f29c6ee
Fixed
10abb34b8dc3e1184de315dd261ce4b77563cda6
Fixed
5119ceb00557bf007f9065709e852686f3c0bb6e
Fixed
83ba67373032334559b82409db035dd8c3cc1660
Fixed
ac38703b2d312200c4f967f02936af0118d384a0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "2.2.0-alpha"
        },
        {
            "fixed": "2.2.2-alpha"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.13"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

release-1.*
release-1.1b
release-2.*
release-2.0.1-alpha
release-2.0.10-stable
release-2.0.3-alpha
release-2.0.4-alpha
release-2.0.5-beta
release-2.0.6-rc
release-2.0.7-rc
release-2.0.8-rc
release-2.0.9-rc
release-2.1.1-alpha
release-2.1.10-stable
release-2.1.11-stable
release-2.1.12-stable
release-2.1.2-alpha
release-2.1.3-alpha
release-2.1.4-alpha
release-2.1.5-beta
release-2.1.6-beta
release-2.1.7-rc
release-2.1.8-stable
release-2.1.9-beta
release-2.2.1-alpha

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63382.json"
vanir_signatures 
[
    {
        "target": {
            "function": "http_check_transfer_encoding_test",
            "file": "test/regress_http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7",
        "id": "CVE-2026-63382-09212634",
        "signature_version": "v1",
        "digest": {
            "length": 554.0,
            "function_hash": "159443554126248192493229143747497657830"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e",
        "id": "CVE-2026-63382-1a3ca03c",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "232009363620329056628390670129698999396",
                "301927956550500463733001079496948051892",
                "302846894707599898881518362108152763491",
                "210052224979536070281137964402414208542"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "evhttp_read_header",
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
        "id": "CVE-2026-63382-266efb72",
        "signature_version": "v1",
        "digest": {
            "length": 1396.0,
            "function_hash": "29720660094429988911624257350654414811"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "evhttp_handle_chunked_read",
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6",
        "id": "CVE-2026-63382-5132a434",
        "signature_version": "v1",
        "digest": {
            "length": 1628.0,
            "function_hash": "54312597686892110452460201251458713018"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "http-internal.h"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
        "id": "CVE-2026-63382-5d193cce",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "292409626913952697780312546128864361636",
                "48911316333907774450032958223250596426",
                "267816818433322696405534976217335938577"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "evhttp_get_body",
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
        "id": "CVE-2026-63382-76f85aff",
        "signature_version": "v1",
        "digest": {
            "length": 1065.0,
            "function_hash": "308400937445130025457393919580388502260"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "test/regress_http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7",
        "id": "CVE-2026-63382-923050c6",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "270762094980121927552802584929566056086",
                "37564212311334647331345684303177453724",
                "168570413533780985513641597969239978857"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "test/regress_http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee",
        "id": "CVE-2026-63382-979e5bed",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "270762094980121927552802584929566056086",
                "37564212311334647331345684303177453724",
                "168570413533780985513641597969239978857"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "http-internal.h"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
        "id": "CVE-2026-63382-a376f433",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "292409626913952697780312546128864361636",
                "48911316333907774450032958223250596426",
                "267816818433322696405534976217335938577"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "evhttp_read_header",
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
        "id": "CVE-2026-63382-a735cfb1",
        "signature_version": "v1",
        "digest": {
            "length": 1411.0,
            "function_hash": "35224490696261019053090315553242569431"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6",
        "id": "CVE-2026-63382-ae20f35d",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "232009363620329056628390670129698999396",
                "301927956550500463733001079496948051892",
                "302846894707599898881518362108152763491",
                "193089320091580699121306918516168648171"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
        "id": "CVE-2026-63382-bce19751",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "99516876717233697971681569441425555600",
                "321505742027719859756484394689243827805",
                "166921988269945208330726582242303544451",
                "272462270128366619676808891365251706672",
                "101739781882283880791711184144758479571",
                "32587973922429444777722015740822682536",
                "229407517677749604417271354969663789061",
                "90178132363687388181821893127025960286",
                "22247395750450916610695992806932819396",
                "151093420082438813915410561791252300143",
                "267146152584600667737937962905459743732",
                "244296681046564776749629984391425551630",
                "299439234693367972321457905101427713020",
                "48529953390494900503685318136989739977",
                "147053079718748745807721029820436526951",
                "79855943815832672741496733684339014390",
                "72162232640439775493263860599031315867",
                "121067529503147623449346205367829540766",
                "135287174655085839407806908039695016964",
                "106599715368436461889311398018389047609",
                "39367626467257698307243720398820909675",
                "118548499515817886124149454694486548706",
                "88111539738133254015713355734017745107",
                "255024896872254468840883927095505426013",
                "114267716138868255645836626147837862319"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "evhttp_get_body",
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
        "id": "CVE-2026-63382-c7f4b032",
        "signature_version": "v1",
        "digest": {
            "length": 1057.0,
            "function_hash": "33556705737908929032215014941627983842"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "test/regress_http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
        "id": "CVE-2026-63382-d881d6ac",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "117476648393786120008123475894810468187",
                "196454199735878072416629015831504004669",
                "252992453727377947888538980413417707756",
                "13973253315252243435508545163209626635",
                "325137767658559788418872616821116612150",
                "274073271136253237971897300002481114705",
                "56045080019540369849887529644493700705"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
        "id": "CVE-2026-63382-da96cabc",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "99516876717233697971681569441425555600",
                "321505742027719859756484394689243827805",
                "166921988269945208330726582242303544451",
                "272462270128366619676808891365251706672",
                "101739781882283880791711184144758479571",
                "32587973922429444777722015740822682536",
                "229407517677749604417271354969663789061",
                "90178132363687388181821893127025960286",
                "22247395750450916610695992806932819396",
                "151093420082438813915410561791252300143",
                "267146152584600667737937962905459743732",
                "244296681046564776749629984391425551630",
                "299439234693367972321457905101427713020",
                "48529953390494900503685318136989739977",
                "38829432815167987044553028529484704729",
                "192148847848684925105003955526074786532",
                "72162232640439775493263860599031315867",
                "121067529503147623449346205367829540766",
                "135287174655085839407806908039695016964",
                "106599715368436461889311398018389047609",
                "39367626467257698307243720398820909675",
                "118548499515817886124149454694486548706",
                "88111539738133254015713355734017745107",
                "255024896872254468840883927095505426013",
                "114267716138868255645836626147837862319"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "http_check_transfer_encoding_test",
            "file": "test/regress_http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee",
        "id": "CVE-2026-63382-ebc5ab94",
        "signature_version": "v1",
        "digest": {
            "length": 554.0,
            "function_hash": "159443554126248192493229143747497657830"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "evhttp_handle_chunked_read",
            "file": "http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e",
        "id": "CVE-2026-63382-f261d987",
        "signature_version": "v1",
        "digest": {
            "length": 1865.0,
            "function_hash": "279418785588684393413854686952928390591"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "test/regress_http.c"
        },
        "deprecated": false,
        "source": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
        "id": "CVE-2026-63382-fa17b9d2",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "117476648393786120008123475894810468187",
                "196454199735878072416629015831504004669",
                "252992453727377947888538980413417707756",
                "44495724699738943335942209210912962144",
                "325137767658559788418872616821116612150",
                "227726402891408782649622989353678379948",
                "227215568266458251496186879841014266776"
            ]
        },
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-08-22T09:15:56Z"