CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling
An unauthenticated remote attacker can exploit HTTP parser inconsistencies in libevent to perform request smuggling, bypassing access controls or poisoning caches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63382?
CVE-2026-63382 is a critical vulnerability in libevent, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Weakness: CWE-444
Which versions are affected by CVE-2026-63382?
How do I fix CVE-2026-63382?
Upgrade to a fixed version.
Is CVE-2026-63382 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63382 exists.
Sources
Also known as AZL-96900, AZL-96944, AZL-97536, AZL-97560, BELL-CVE-2026-63382, CLSA-2026-1792718226 and 5 more.