Header Smuggling Vulnerability in Libevent Affects Multiple Releases
CVE-2026-63379

6.3MEDIUM

Key Information:

Vendor

Libevent

Status
Libevent
Vendor
CVE Published:
20 August 2026

What is CVE-2026-63379?

Libevent, an event notification library, contains a vulnerability related to how it processes chunked HTTP trailers. Prior to versions 2.1.13 and 2.2.2-alpha, the library improperly merged security-sensitive fields found in trailers with request headers. This flaw can be exploited by unauthenticated remote attackers, allowing them to carry out header smuggling, proxy-header spoofing, or even cache poisoning. In response, versions 2.1.13 and 2.2.2-alpha have been updated to introduce a new parsing method for headers that creates a temporary header list, effectively mitigating the risks associated with trailer manipulation.

Affected Version(s)

libevent < 2.1.13 < 2.1.13

libevent >= 2.2.0-alpha, < 2.2.2-alpha < 2.2.0-alpha, 2.2.2-alpha

References

https://github.com/libevent/libevent/security/advisories/...
x_refsource_CONFIRM
https://github.com/libevent/libevent/commit/87e8e44fa774e...
x_refsource_MISC
https://github.com/libevent/libevent/commit/b847071141b38...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.