CVE-2026-63379 Libevent: HTTP Header smuggling
Remote attackers can exploit HTTP header smuggling in Libevent to bypass authorization, spoof proxy headers, or poison caches by manipulating chunked trailers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63379?
CVE-2026-63379 is a medium-severity vulnerability in libevent, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Weakness: CWE-444
Which versions are affected by CVE-2026-63379?
How do I fix CVE-2026-63379?
Upgrade to a fixed version.
Is CVE-2026-63379 being exploited?
There is no known exploitation of CVE-2026-63379 in the wild and no public exploit code.
Sources
Also known as AZL-96903, AZL-96941, AZL-97533, AZL-97557, BELL-CVE-2026-63379, DEBIAN-CVE-2026-63379 and 3 more.