CVE-2026-63382

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63382
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63382.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63382
Aliases
  • GHSA-q39v-w2g7-gr8j
Downstream
AZL (4)
BELL (1)
CLSA (5)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (1)
RHSA (4)
RLSA (3)
ROOT (3)
UBUNTU (1)
Related
ALSA (3)
Published
2026-08-20T17:51:15Z
Modified
2026-10-28T10:58:02Z
Severity
  • 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N CVSS Calculator
Summary
libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling
Details

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-444"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63382.json"
}
References

Affected packages

Git / github.com/libevent/libevent

Affected ranges

Type
GIT
Repo
https://github.com/libevent/libevent
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
df3ecad3a040fd6d4fad4287defe113395de6fd7
Fixed
79ddfb460847999b807cba76d04e73891f29c6ee
Fixed
10abb34b8dc3e1184de315dd261ce4b77563cda6
Fixed
5119ceb00557bf007f9065709e852686f3c0bb6e
Fixed
83ba67373032334559b82409db035dd8c3cc1660
Fixed
ac38703b2d312200c4f967f02936af0118d384a0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.2.0-alpha"
                },
                {
                    "fixed":  "2.2.2-alpha"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.1.13"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "10abb34b8dc3e1184de315dd261ce4b77563cda6"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "5119ceb00557bf007f9065709e852686f3c0bb6e"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "83ba67373032334559b82409db035dd8c3cc1660"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "ac38703b2d312200c4f967f02936af0118d384a0"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "release-2.1.13-stable",
            "range":  [
                {
                    "fixed":  "79ddfb460847999b807cba76d04e73891f29c6ee"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "release-2.2.2-alpha",
            "range":  [
                {
                    "fixed":  "df3ecad3a040fd6d4fad4287defe113395de6fd7"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

release-1.*
release-1.1b
release-2.*
release-2.0.1-alpha
release-2.0.10-stable
release-2.0.3-alpha
release-2.0.4-alpha
release-2.0.5-beta
release-2.0.6-rc
release-2.0.7-rc
release-2.0.8-rc
release-2.0.9-rc
release-2.1.1-alpha
release-2.1.10-stable
release-2.1.11-stable
release-2.1.12-stable
release-2.1.2-alpha
release-2.1.3-alpha
release-2.1.4-alpha
release-2.1.5-beta
release-2.1.6-beta
release-2.1.7-rc
release-2.1.8-stable
release-2.1.9-beta
release-2.2.1-alpha

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63382.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "232009363620329056628390670129698999396",
                "301927956550500463733001079496948051892",
                "302846894707599898881518362108152763491",
                "210052224979536070281137964402414208542"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63382-1a3ca03c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e",
        "target":  {
            "file":  "http.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "54312597686892110452460201251458713018",
            "length":  1628
        },
        "id":  "CVE-2026-63382-5132a434",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6",
        "target":  {
            "file":  "http.c",
            "function":  "evhttp_handle_chunked_read"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "292409626913952697780312546128864361636",
                "48911316333907774450032958223250596426",
                "267816818433322696405534976217335938577"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63382-5d193cce",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
        "target":  {
            "file":  "http-internal.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "308400937445130025457393919580388502260",
            "length":  1065
        },
        "id":  "CVE-2026-63382-76f85aff",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
        "target":  {
            "file":  "http.c",
            "function":  "evhttp_get_body"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "292409626913952697780312546128864361636",
                "48911316333907774450032958223250596426",
                "267816818433322696405534976217335938577"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63382-a376f433",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
        "target":  {
            "file":  "http-internal.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "35224490696261019053090315553242569431",
            "length":  1411
        },
        "id":  "CVE-2026-63382-a735cfb1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
        "target":  {
            "file":  "http.c",
            "function":  "evhttp_read_header"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "232009363620329056628390670129698999396",
                "301927956550500463733001079496948051892",
                "302846894707599898881518362108152763491",
                "193089320091580699121306918516168648171"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63382-ae20f35d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6",
        "target":  {
            "file":  "http.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "117476648393786120008123475894810468187",
                "196454199735878072416629015831504004669",
                "252992453727377947888538980413417707756",
                "13973253315252243435508545163209626635",
                "325137767658559788418872616821116612150",
                "274073271136253237971897300002481114705",
                "56045080019540369849887529644493700705"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63382-d881d6ac",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
        "target":  {
            "file":  "test/regress_http.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "279418785588684393413854686952928390591",
            "length":  1865
        },
        "id":  "CVE-2026-63382-f261d987",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e",
        "target":  {
            "file":  "http.c",
            "function":  "evhttp_handle_chunked_read"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "117476648393786120008123475894810468187",
                "196454199735878072416629015831504004669",
                "252992453727377947888538980413417707756",
                "44495724699738943335942209210912962144",
                "325137767658559788418872616821116612150",
                "227726402891408782649622989353678379948",
                "227215568266458251496186879841014266776"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63382-fa17b9d2",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
        "target":  {
            "file":  "test/regress_http.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:58:02Z"