CVE-2026-63379
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
What this means for your business
- FIRST's prediction model gives it a 0.7% chance of attack attempts being seen in the next 30 days, ranking above 51% of all known flaws.
What to do
- 1Ask your IT team or provider whether any of your systems use the affected product.
- 2If you do, follow the vendor's guidance. No patch reference has been published yet.
Not sure if your company is exposed?
Fastnexa’s certified penetration testers can check whether attackers could use this flaw, or others like it, against your websites, apps and network. The full test is free for our first 10 founding clients until 31 December 2026.
Scoring
- CVSS
- Not yet scored
- CVSS v4
- 6.3
- Weakness
- CWE-444
- Assigned by
- security-advisories@github.com
Dates
- Published
- 2026-08-20
- Last modified
- 2026-09-09
- Sources
- NVD
References
- https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636
- https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485
- https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
- https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
- https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6