CVE-2026-63382criticalCWE-444

CVE-2026-63382: falha crítica em libevent

libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Publicada em

Seguir esta CVE+ Monitorar libevent+ Monitorar libevent

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.8%
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N
Produtos afetados
libevent · libevent
CVEs relacionadas — libevent

No mesmo produto, das mais perigosas para as menos.

CVE-2026-63385CRITICALLibevent: HTTP header handling bugs create risk of access control bypass.EPSS 1.3%CVE-2026-63379MEDIUMLibevent: HTTP Header smugglingEPSS 0.7%CVE-2026-63495HIGHLibevent: Unbounded memory accumulation in WebSocket server via fragmented framesEPSS 0.6%CVE-2026-63384HIGHLibevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.EPSS 0.5%CVE-2026-63383HIGHLibevent: decode_tag_internal() can lead to out-of-bounds readEPSS 0.5%CVE-2026-63387HIGHLibevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server responseEPSS 0.4%