Libevent prior 2.1.13/2.2.2-alpha HTTP Trailer Processing http.c evhttp_read_trailer authorization

Summaryinfo

A vulnerability, which was classified as critical, has been found in Libevent. Affected is the function evhttp_read_trailer of the file http.c of the component HTTP Trailer Processing. The manipulation leads to authorization. This vulnerability is documented as CVE-2026-63379. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Libevent. It has been rated as critical. This issue affects the function evhttp_read_trailer of the file http.c of the component HTTP Trailer Processing. The manipulation with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-63379 since 07/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

Upgrading to version 2.1.13 or 2.2.2-alpha eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Libevent

Website

• Product: https://github.com/libevent/libevent/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion