CVE-2026-63382 – HTTP Request Smuggling – libevent evhttp < 2.1.13 and 2.2.0-alpha–2.2.2-alpha

Summary

CVE-2026-63382 is a critical HTTP request smuggling vulnerability (CWE-444: Inconsistent Interpretation of HTTP Requests) in the evhttp HTTP server/parser component of libevent, a widely embedded C library for asynchronous event notification used by many network daemons and applications. The flaw stems from multiple inconsistencies in how evhttp parses headers, Transfer-Encoding values, and chunked bodies, allowing an unauthenticated network attacker to desynchronize how a front-end proxy and a libevent-based backend interpret the boundaries of HTTP requests. The issue has a critical severity rating of 9.2 and is remotely exploitable with no authentication or user interaction required.

Technical details

• Root cause: Three related parsing defects in evhttp:
  • evhttp_find_header() only inspects the first occurrence of a duplicated header (e.g., Transfer-Encoding), ignoring subsequent instances that a front-end proxy might parse differently.
  • The library lacked a dedicated evhttp_check_transfer_encoding_ routine; the prior whole-string comparison logic failed to recognize valid comma-separated Transfer-Encoding lists that end in chunked, leading to inconsistent handling of the header value.
  • evhttp_handle_chunked_read() used the looser EVBUFFER_EOL_CRLF line-ending mode instead of EVBUFFER_EOL_CRLF_STRICT, allowing bare line feeds to be accepted as valid line terminators in chunked-encoded bodies.
• Trigger conditions: An attacker sends a crafted HTTP request (duplicate/ambiguous Transfer-Encoding headers, or chunked bodies using non-strict CRLF sequences) to a libevent-based evhttp server that sits behind a reverse proxy or load balancer with different framing rules.
• Attack vector: Network, no privileges or user interaction required (remote, unauthenticated).
• Impact: Request boundary desynchronization ("HTTP request smuggling") between the proxy and the libevent backend, which can be leveraged to bypass access controls, poison caches, hijack or inject requests into other users’ connections, and potentially achieve further compromise depending on the deployed application logic.

Affected software

• libevent versions prior to 2.1.13
• libevent versions 2.2.0-alpha up to (but not including) 2.2.2-alpha

Severity

• CVSS Score: 9.2 (Critical)
• CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N
• Attack Vector: Network

Mitigation and recommended actions

• Immediate: Upgrade libevent to 2.1.13 (stable branch) or 2.2.2-alpha (alpha branch), both of which include fixes that restrict HTTP header parsing, properly validate Transfer-Encoding lists, discard HTTP trailers, and enforce strict CRLF handling for chunked bodies.
• If patching is not immediately possible:
  • Ensure any reverse proxies or load balancers in front of libevent-based evhttp servers normalize and reject ambiguous requests (e.g., requests containing both Content-Length and Transfer-Encoding, duplicate Transfer-Encoding headers, or non-CRLF-terminated chunked lines) before forwarding them.
  • Where possible, terminate HTTP parsing consistently at a single layer (e.g., disable HTTP/1.1 keep-alive or chunked transfer support at the proxy) to reduce the risk of framing disagreements between proxy and backend.
  • Monitor and audit any internet-facing services built on evhttp for anomalous or duplicated framing headers.
  • Rebuild and redeploy any applications that statically link libevent once the underlying library dependency has been updated.

References

• CVE-2026-63382 record (CVE Project)
• GitHub Security Advisory GHSA-q39v-w2g7-gr8j (libevent evhttp request smuggling)
• libevent 2.1.13-stable release notes