{"id":"CVE-2026-63382","summary":"libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling","details":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","aliases":["GHSA-q39v-w2g7-gr8j"],"modified":"2026-10-28T10:58:02.146319874Z","published":"2026-08-20T17:51:15.156Z","related":["ALSA-2026:67908","ALSA-2026:67909","ALSA-2026:67910"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-444"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63382.json"},"references":[{"type":"WEB","url":"https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"},{"type":"WEB","url":"https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63382.json"},{"type":"ADVISORY","url":"https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63382"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libevent/libevent","events":[{"introduced":"0"},{"fixed":"df3ecad3a040fd6d4fad4287defe113395de6fd7"},{"fixed":"79ddfb460847999b807cba76d04e73891f29c6ee"},{"fixed":"10abb34b8dc3e1184de315dd261ce4b77563cda6"},{"fixed":"5119ceb00557bf007f9065709e852686f3c0bb6e"},{"fixed":"83ba67373032334559b82409db035dd8c3cc1660"},{"fixed":"ac38703b2d312200c4f967f02936af0118d384a0"}],"database_specific":{"extracted_events":[{"strategy":"StringRangeExpression","range":[{"introduced":"2.2.0-alpha"},{"fixed":"2.2.2-alpha"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"0"},{"fixed":"2.1.13"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"10abb34b8dc3e1184de315dd261ce4b77563cda6"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"5119ceb00557bf007f9065709e852686f3c0bb6e"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"83ba67373032334559b82409db035dd8c3cc1660"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"ac38703b2d312200c4f967f02936af0118d384a0"}]},{"range":[{"fixed":"79ddfb460847999b807cba76d04e73891f29c6ee"}],"source":"REFERENCES_TAG","original_tag":"release-2.1.13-stable"},{"source":"REFERENCES_TAG","original_tag":"release-2.2.2-alpha","range":[{"fixed":"df3ecad3a040fd6d4fad4287defe113395de6fd7"}]}]}}],"versions":["release-2.1.12-stable","release-2.2.1-alpha","release-2.1.11-stable","release-2.1.10-stable","release-2.1.9-beta","release-2.1.8-stable","release-2.1.7-rc","release-2.1.6-beta","release-2.1.5-beta","release-2.1.4-alpha","release-2.1.3-alpha","release-2.1.2-alpha","release-2.1.1-alpha","release-2.0.10-stable","release-2.0.9-rc","release-2.0.8-rc","release-2.0.7-rc","release-2.0.6-rc","release-2.0.5-beta","release-2.0.4-alpha","release-2.0.3-alpha","release-2.0.1-alpha","release-1.1b"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63382.json","vanir_signatures":[{"source":"https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e","target":{"file":"http.c"},"deprecated":false,"digest":{"line_hashes":["232009363620329056628390670129698999396","301927956550500463733001079496948051892","302846894707599898881518362108152763491","210052224979536070281137964402414208542"],"threshold":0.9},"id":"CVE-2026-63382-1a3ca03c","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-63382-5132a434","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6","target":{"function":"evhttp_handle_chunked_read","file":"http.c"},"deprecated":false,"digest":{"function_hash":"54312597686892110452460201251458713018","length":1628}},{"target":{"file":"http-internal.h"},"deprecated":false,"digest":{"line_hashes":["292409626913952697780312546128864361636","48911316333907774450032958223250596426","267816818433322696405534976217335938577"],"threshold":0.9},"id":"CVE-2026-63382-5d193cce","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0"},{"source":"https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660","target":{"file":"http.c","function":"evhttp_get_body"},"deprecated":false,"digest":{"function_hash":"308400937445130025457393919580388502260","length":1065},"id":"CVE-2026-63382-76f85aff","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-63382-a376f433","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660","target":{"file":"http-internal.h"},"deprecated":false,"digest":{"line_hashes":["292409626913952697780312546128864361636","48911316333907774450032958223250596426","267816818433322696405534976217335938577"],"threshold":0.9}},{"source":"https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660","target":{"file":"http.c","function":"evhttp_read_header"},"deprecated":false,"digest":{"length":1411,"function_hash":"35224490696261019053090315553242569431"},"id":"CVE-2026-63382-a735cfb1","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["232009363620329056628390670129698999396","301927956550500463733001079496948051892","302846894707599898881518362108152763491","193089320091580699121306918516168648171"]},"id":"CVE-2026-63382-ae20f35d","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6","target":{"file":"http.c"},"deprecated":false},{"digest":{"line_hashes":["117476648393786120008123475894810468187","196454199735878072416629015831504004669","252992453727377947888538980413417707756","13973253315252243435508545163209626635","325137767658559788418872616821116612150","274073271136253237971897300002481114705","56045080019540369849887529644493700705"],"threshold":0.9},"id":"CVE-2026-63382-d881d6ac","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660","target":{"file":"test/regress_http.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"279418785588684393413854686952928390591","length":1865},"id":"CVE-2026-63382-f261d987","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e","target":{"file":"http.c","function":"evhttp_handle_chunked_read"}},{"id":"CVE-2026-63382-fa17b9d2","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0","target":{"file":"test/regress_http.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["117476648393786120008123475894810468187","196454199735878072416629015831504004669","252992453727377947888538980413417707756","44495724699738943335942209210912962144","325137767658559788418872616821116612150","227726402891408782649622989353678379948","227215568266458251496186879841014266776"]}}],"vanir_signatures_modified":"2026-10-28T10:58:02Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N"}]}