CVE-2026-63382

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63382", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T17:39:30.171Z", "datePublished": "2026-08-20T17:51:15.156Z", "dateUpdated": "2026-08-20T19:33:50.217Z"}, "containers": {"cna": {"title": "libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling", "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "lang": "en", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"}, {"name": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6"}, {"name": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e"}, {"name": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660"}, {"name": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0"}, {"name": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"}, {"name": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"}], "affected": [{"vendor": "libevent", "product": "libevent", "versions": [{"version": ">= 2.2.0-alpha, < 2.2.2-alpha", "status": "affected"}, {"version": "< 2.1.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T17:51:15.156Z"}, "descriptions": [{"lang": "en", "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}], "source": {"advisory": "GHSA-q39v-w2g7-gr8j", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T19:33:43.608585Z", "id": "CVE-2026-63382", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:33:50.217Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63382", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-20T19:33:43.608585Z"}}}], "references": [{"url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T19:33:25.067Z"}}], "cna": {"title": "libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling", "source": {"advisory": "GHSA-q39v-w2g7-gr8j", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "libevent", "product": "libevent", "versions": [{"status": "affected", "version": ">= 2.2.0-alpha, < 2.2.2-alpha"}, {"status": "affected", "version": "< 2.1.13"}]}], "references": [{"url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j", "name": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6", "name": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e", "name": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660", "name": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0", "name": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable", "name": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha", "name": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T17:51:15.156Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63382", "state": "PUBLISHED", "dateUpdated": "2026-08-20T19:33:50.217Z", "dateReserved": "2026-07-16T17:39:30.171Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-20T17:51:15.156Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "libevent", "vendor": "libevent", "versions": [{"status": "affected", "version": ">= 2.2.0-alpha, < 2.2.2-alpha"}, {"status": "affected", "version": "< 2.1.13"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}, {"lang": "es", "value": "Libevent es una biblioteca de notificaci\u00f3n de eventos. Antes de 2.1.13 y 2.2.2-alpha, el analizador evhttp de libevent en http.c maneja de forma inconsistente los encabezados Transfer-Encoding duplicados, los valores Transfer-Encoding separados por comas y los saltos de l\u00ednea simples en el encuadre fragmentado. evhttp_find_header solo puede seleccionar el primer encabezado, evhttp_check_transfer_encoding_ estaba ausente, por lo que la comparaci\u00f3n de cadena completa anterior no reconoce listas v\u00e1lidas que terminan en chunked, y evhttp_handle_chunked_read usa EVBUFFER_EOL_CRLF en lugar de EVBUFFER_EOL_CRLF_STRICT, aceptando terminadores de fragmento LF simples. Cuando libevent se implementa detr\u00e1s de un proxy que enmarca la misma solicitud de manera diferente, un atacante remoto no autenticado puede desincronizar los l\u00edmites de la solicitud y contrabandear una segunda solicitud, lo que podr\u00eda eludir los controles de acceso o envenenar las cach\u00e9s. Este problema se soluciona en las versiones 2.1.13 y 2.2.2-alpha."}], "id": "CVE-2026-63382", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63382", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T19:33:43.608585Z", "version": "2.0.3"}}]}, "published": "2026-08-20T18:16:35.700", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling", "id": "2520660", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520660"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-444", "details": ["Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successful exploitation could lead to request smuggling, potentially bypassing access controls or poisoning caches."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-63382", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "libevent2", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-20T17:51:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63382\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63382\nhttps://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6\nhttps://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e\nhttps://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660\nhttps://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0\nhttps://github.com/libevent/libevent/releases/tag/release-2.1.13-stable\nhttps://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha\nhttps://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"], "statement": "Red Hat Enterprise Linux, OpenShift (RHCOS), RHIVOS, and community products (Fedora, Hummingbird) ship affected versions of libevent.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0-alpha,2.2.2-alpha)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.13)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "libevent", "source": "cna", "vendor": "libevent"}, "product": "libevent", "vendor": "libevent_project"}], "created": "2026-08-21T02:15:04.424574+00:00", "updated": "2026-11-07T14:30:09.761274+00:00", "vendors": ["libevent_project", "libevent_project$PRODUCT$libevent"]}