CVE-2026-63379 in Libevent
Summary
by MITRE • 08/20/2026
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
Libevent serves as a widely adopted event notification library for network applications, providing robust abstractions for handling asynchronous I/O operations across various platforms. A critical security vulnerability was identified within the HTTP parsing logic of this library, specifically affecting versions prior to 2.1.13 and 2.2.2-alpha. The flaw resides in how the library processes chunked transfer encoding trailers via the evhttp_read_trailer function. In vulnerable implementations, these trailers were directly merged into the main request header structure rather than being treated as distinct metadata or discarded appropriately for standard HTTP semantics. This architectural oversight creates a significant divergence between how libevent interprets incoming data and how upstream infrastructure components interpret it.
The core technical flaw is classified under CWE-75: Header Injection, which allows an attacker to inject malicious content into headers that are then processed by downstream systems. By exploiting the improper handling of chunked HTTP trailers, an unauthenticated remote attacker can craft requests where security-sensitive fields are embedded within the trailer section rather than the primary header block. Because upstream proxies and load balancers often parse these trailers differently or ignore them entirely for certain operations while libevent merges them into its internal request object, a state mismatch occurs. This discrepancy enables HTTP Request Smuggling, a technique that exploits differences in how sequential layers of servers interpret message boundaries and headers to confuse the proxy chain.
The operational impact of this vulnerability is severe due to the potential for authorization bypasses and cache poisoning attacks. When an attacker successfully smuggles headers through trailer injection, they can manipulate authentication tokens or access control directives that are evaluated by libevent but not recognized by upstream proxies. This allows unauthorized users to gain elevated privileges or access restricted resources without valid credentials. Furthermore, if the application interacts with caching mechanisms such as CDNs or reverse proxy caches, the ability to spoof headers via trailers can lead to cache poisoning. Attackers may force the storage of malicious responses under specific URLs, causing subsequent legitimate requests from other users to receive compromised content, thereby facilitating cross-site scripting or phishing campaigns against unsuspecting victims.
Mitigation strategies primarily involve upgrading libevent to version 2.1.13 or later for the stable branch and 2.2.2-alpha or later for development branches. The fix addresses this issue by introducing a new internal function evhttp_parse_headers_impl_ which handles header parsing more securely. Crucially, the updated implementation parses trailers into a temporary list that is subsequently discarded rather than merging them into the persistent request input headers structure. This ensures that trailer data does not interfere with standard HTTP header processing logic used for security decisions and routing. Organizations relying on libevent should verify their dependency versions immediately to prevent exploitation of this vector in production environments where external-facing services are hosted.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1503.002: Server-Side Request Forgery via Header Injection and is relevant to the broader category of HTTP Protocol Attacks described under MITRE ATT&CK sub-techniques related to request smuggling. Security teams should monitor for anomalous traffic patterns involving chunked transfer encoding with unusual trailer fields, particularly those containing authentication or authorization keywords. Implementing strict input validation at the application layer in addition to upgrading libraries provides defense-in-depth against such protocol-level ambiguities that attackers frequently leverage to bypass perimeter security controls and internal access policies.