{"id":"CVE-2026-63385","summary":"Libevent: HTTP header handling bugs create risk of access control bypass.","details":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.","aliases":["GHSA-jcwh-pvf2-73p2"],"modified":"2026-09-11T08:36:40.897190Z","published":"2026-08-20T17:55:36.214Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63385.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-444"]},"references":[{"type":"WEB","url":"https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"},{"type":"WEB","url":"https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63385.json"},{"type":"ADVISORY","url":"https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63385"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libevent/libevent","events":[{"introduced":"0"},{"fixed":"df3ecad3a040fd6d4fad4287defe113395de6fd7"},{"fixed":"79ddfb460847999b807cba76d04e73891f29c6ee"},{"fixed":"758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0"},{"fixed":"9170dd35e64714613e8d13b290587cfc28e258e2"}],"database_specific":{"extracted_events":[{"introduced":"2.2.0-alpha"},{"fixed":"2.2.2-alpha"},{"introduced":"0"},{"fixed":"2.1.13"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["release-2.1.12-stable","release-2.2.1-alpha","release-2.1.11-stable","release-2.1.10-stable","release-2.1.9-beta","release-2.1.8-stable","release-2.1.7-rc","release-2.1.6-beta","release-2.1.5-beta","release-2.1.4-alpha","release-2.1.3-alpha","release-2.1.2-alpha","release-2.1.1-alpha","release-2.0.10-stable","release-2.0.9-rc","release-2.0.8-rc","release-2.0.7-rc","release-2.0.6-rc","release-2.0.5-beta","release-2.0.4-alpha","release-2.0.3-alpha","release-2.0.1-alpha","release-1.1b"],"database_specific":{"vanir_signatures_modified":"2026-09-11T08:36:40Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7","target":{"function":"http_check_transfer_encoding_test","file":"test/regress_http.c"},"deprecated":false,"digest":{"function_hash":"159443554126248192493229143747497657830","length":554},"id":"CVE-2026-63385-09212634","signature_type":"Function"},{"source":"https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2","target":{"file":"test/regress_http.c"},"deprecated":false,"digest":{"line_hashes":["248332385648104782046694678277210168338","61183333473211860754687236167259228973","105978649520773873069646351304692352328","250769086247804005082677166275449811672"],"threshold":0.9},"id":"CVE-2026-63385-113b559f","signature_type":"Line","signature_version":"v1"},{"target":{"file":"http.c","function":"evhttp_header_is_valid_value"},"deprecated":false,"digest":{"function_hash":"335594123686192924095430681468915382294","length":237},"id":"CVE-2026-63385-18a5f683","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2"},{"source":"https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0","target":{"file":"http.c","function":"evhttp_header_is_valid_value"},"deprecated":false,"digest":{"function_hash":"335594123686192924095430681468915382294","length":237},"id":"CVE-2026-63385-3e0b8d30","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-63385-5acea964","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0","target":{"file":"http.c"},"deprecated":false,"digest":{"line_hashes":["156454671672876299134337389795275260119","156027312396034977093912409873686874581","102722108278382698140429358542757673773","94331243378865506034083474685728319493","141712309207802533389296252575811444198","133457342464639888588708177849864410468","134792771592966456779690561609829698813","210207466198600775572847048660845316437"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"253573145327419661989798637302208732748","length":453},"id":"CVE-2026-63385-8d6343be","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2","target":{"file":"test/regress_http.c","function":"http_bad_header_test"}},{"target":{"file":"test/regress_http.c"},"deprecated":false,"digest":{"line_hashes":["270762094980121927552802584929566056086","37564212311334647331345684303177453724","168570413533780985513641597969239978857"],"threshold":0.9},"id":"CVE-2026-63385-923050c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee","target":{"file":"test/regress_http.c"},"deprecated":false,"digest":{"line_hashes":["270762094980121927552802584929566056086","37564212311334647331345684303177453724","168570413533780985513641597969239978857"],"threshold":0.9},"id":"CVE-2026-63385-979e5bed"},{"target":{"file":"test/regress_http.c","function":"http_bad_header_test"},"deprecated":false,"digest":{"length":507,"function_hash":"228949190804516355688751677182701710512"},"id":"CVE-2026-63385-9d6f7bdc","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0"},{"signature_version":"v1","source":"https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0","target":{"file":"test/regress_http.c"},"deprecated":false,"digest":{"line_hashes":["248332385648104782046694678277210168338","20167817516379386618153487950901174280","295196270722037179760886109700183996570","313871568211194703002041502874636650865","11699147308460220707870682643594677201"],"threshold":0.9},"id":"CVE-2026-63385-d4b2fa03","signature_type":"Line"},{"id":"CVE-2026-63385-e7694267","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2","target":{"file":"http.c"},"deprecated":false,"digest":{"line_hashes":["156454671672876299134337389795275260119","156027312396034977093912409873686874581","102722108278382698140429358542757673773","94331243378865506034083474685728319493","141712309207802533389296252575811444198","133457342464639888588708177849864410468","134792771592966456779690561609829698813","210207466198600775572847048660845316437"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"159443554126248192493229143747497657830","length":554},"id":"CVE-2026-63385-ebc5ab94","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee","target":{"file":"test/regress_http.c","function":"http_check_transfer_encoding_test"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63385.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N"}]}