CVE-2026-63379

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

• CWE-444

• https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636
• https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485
• https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
• https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
• https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6

Published

Aug 20, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6336GitLab has remediated an issue in GitLab CE/EE affecting all…5.3
• CVE-2026-63360LimeSurvey Community Edition 7.0.5+260623 contains an authen…7.4
• CVE-2026-63361LimeSurvey Community Edition 7.0.5 contains an authenticated…8.5
• CVE-2026-63362An unsigned integer underflow in the PubSub signature verifi…5.9
• CVE-2026-6337Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-63376toml-node is a TOML parser for Node.js and the browser. Prio…8.2
• CVE-2026-6338A HTTP request smuggling and desynchronization vulnerability…4.9
• CVE-2026-63380Libevent is an event notification library. Prior to 2.2.2-al…5.7
• CVE-2026-63381Libevent is an event notification library. Prior to 2.1.13 a…5.8
• CVE-2026-63382Libevent is an event notification library. Prior to 2.1.13 a…9.2
• CVE-2026-63383Libevent is an event notification library. Prior to 2.1.13 a…8.7
• CVE-2026-63384Libevent is an event notification library. Prior to 2.1.13 a…8.7