{"id":"CVE-2026-63379","summary":"Libevent: HTTP Header smuggling","details":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req-\u003einput_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","aliases":["GHSA-2gmv-p5m7-98p6"],"modified":"2026-08-22T09:15:55.565945Z","published":"2026-08-20T17:55:00.789Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-444"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63379.json"},"references":[{"type":"WEB","url":"https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"},{"type":"WEB","url":"https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63379.json"},{"type":"ADVISORY","url":"https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63379"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libevent/libevent","events":[{"introduced":"0"},{"fixed":"79ddfb460847999b807cba76d04e73891f29c6ee"},{"fixed":"df3ecad3a040fd6d4fad4287defe113395de6fd7"},{"fixed":"87e8e44fa774e9677b089b1a5114ee68aefa1636"},{"fixed":"b847071141b3827900d536594ec9045eb0a4c485"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.1.13"},{"introduced":"2.2.0-alpha"},{"fixed":"2.2.2-alpha"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["release-2.1.12-stable","release-2.2.1-alpha","release-2.1.11-stable","release-2.1.10-stable","release-2.1.9-beta","release-2.1.8-stable","release-2.1.7-rc","release-2.1.6-beta","release-2.1.5-beta","release-2.1.4-alpha","release-2.1.3-alpha","release-2.1.2-alpha","release-2.1.1-alpha","release-2.0.10-stable","release-2.0.9-rc","release-2.0.8-rc","release-2.0.7-rc","release-2.0.6-rc","release-2.0.5-beta","release-2.0.4-alpha","release-2.0.3-alpha","release-2.0.1-alpha","release-1.1b"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63379.json","vanir_signatures_modified":"2026-08-22T09:15:55Z","vanir_signatures":[{"source":"https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7","target":{"function":"http_check_transfer_encoding_test","file":"test/regress_http.c"},"deprecated":false,"digest":{"function_hash":"159443554126248192493229143747497657830","length":554},"id":"CVE-2026-63379-09212634","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"239504701231416308484423487682461223518","length":1078},"id":"CVE-2026-63379-22a71ff7","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636","target":{"function":"evhttp_parse_headers_","file":"http.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636","target":{"file":"http.c","function":"evhttp_read_trailer"},"deprecated":false,"digest":{"function_hash":"9779685853636844600237555984948255248","length":400},"id":"CVE-2026-63379-27eb3b71"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636","target":{"file":"http.c"},"deprecated":false,"digest":{"line_hashes":["65111243531268974160005605360168170935","107620246626032186158942398086015465687","69869366833060082186002060033350453026","55259272766720684467672970472695269898","234603135147329347214211908465286217700","78730403153954306194617078068637848293","80237498898681536292115697206606056770","240443224918776039178248009011788522320","59143161919021300068775172641979361755","176906661887520979065380937045951660796","163365333947463192760216260292028193514","168796573672783060897495388077642159493","127667215342036913072137726559158981757","187348593281087902192458226295844241873","86806918437872607352809874018987564456","79257392173898998873557695382809743988","77512930519195976976646711584088059470","85624624188710027250081749540922243152","239905070383706960393275708850418194014","272698428298809456881166400176874945890","217589744529312143789544007237481523776","139972510930712699336452955734570707814","50787474251233255544722177200512141142","25561295225117548668558692988639291720","291054240583102250515045063880116613532","208920865826417499957446877419600210938","120360035151430792179527738819835803987","55471229886145665608233624668390955870","244296681046564776749629984391425551630"],"threshold":0.9},"id":"CVE-2026-63379-28ecf218"},{"deprecated":false,"digest":{"function_hash":"9779685853636844600237555984948255248","length":400},"id":"CVE-2026-63379-73ab94e9","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485","target":{"file":"http.c","function":"evhttp_read_trailer"}},{"digest":{"function_hash":"239504701231416308484423487682461223518","length":1078},"id":"CVE-2026-63379-7c0a301a","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485","target":{"file":"http.c","function":"evhttp_parse_headers_"},"deprecated":false},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["270762094980121927552802584929566056086","37564212311334647331345684303177453724","168570413533780985513641597969239978857"]},"id":"CVE-2026-63379-923050c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7","target":{"file":"test/regress_http.c"}},{"digest":{"line_hashes":["270762094980121927552802584929566056086","37564212311334647331345684303177453724","168570413533780985513641597969239978857"],"threshold":0.9},"id":"CVE-2026-63379-979e5bed","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee","target":{"file":"test/regress_http.c"},"deprecated":false},{"id":"CVE-2026-63379-bd70cf62","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485","target":{"file":"http.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["121866999892246749841477517448919568061","218940061900138967527574999999031688584","46040490677877218218042447030091681825","67710350957676641751739359323947755555","234603135147329347214211908465286217700","78730403153954306194617078068637848293","80237498898681536292115697206606056770","240443224918776039178248009011788522320","59143161919021300068775172641979361755","176906661887520979065380937045951660796","163365333947463192760216260292028193514","168796573672783060897495388077642159493","127667215342036913072137726559158981757","187348593281087902192458226295844241873","86806918437872607352809874018987564456","79257392173898998873557695382809743988","77512930519195976976646711584088059470","85624624188710027250081749540922243152","239905070383706960393275708850418194014","272698428298809456881166400176874945890","217589744529312143789544007237481523776","139972510930712699336452955734570707814","50787474251233255544722177200512141142","25561295225117548668558692988639291720","291054240583102250515045063880116613532","208920865826417499957446877419600210938","120360035151430792179527738819835803987","55471229886145665608233624668390955870","244296681046564776749629984391425551630"]}},{"target":{"function":"http_check_transfer_encoding_test","file":"test/regress_http.c"},"deprecated":false,"digest":{"function_hash":"159443554126248192493229143747497657830","length":554},"id":"CVE-2026-63379-ebc5ab94","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"}]}