HTTP Parsing Weaknesses in Libevent Library Affect Libevent Products
CVE-2026-63385
What is CVE-2026-63385?
Libevent, an event notification library, has notable HTTP parsing vulnerabilities linked to the handling of percent-encoded NUL characters in URIs and obsolete CRLF line folding in headers. Specifically, the “evhttp_decode_uri_internal” function improperly processes %00 characters, potentially leading to path truncation and bypassing of validation checks. Additionally, the “evhttp_header_is_valid_value” function's acceptance of outdated line folding can facilitate header injection and access control bypass issues, compromising security. Fixes have been implemented in versions 2.1.13 and 2.2.2-alpha, but previous versions remain susceptible to these vulnerabilities.
Affected Version(s)
libevent >= 2.2.0-alpha, < 2.2.2-alpha < 2.2.0-alpha, 2.2.2-alpha
libevent < 2.1.13 < 2.1.13