Input validation error in libevent - CVE-2026-63379

Vulnerability identifier: #VU136952

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-63379

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to smuggle HTTP headers.

The vulnerability exists due to improper input validation in the evhttp_read_trailer function in http.c when processing HTTP trailer fields in chunked encoded requests. A remote attacker can send a specially crafted chunked HTTP request with malicious trailer headers to smuggle HTTP headers.

This can lead to request desynchronization, cache poisoning, access control bypass, or host header manipulation in deployments that trust or process the merged headers.

libevent
Debian Linux
IBM i
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
openEuler
Fedora
libevent
libevent-debuginfo
libevent-debugsource
libevent-devel
libevent (Debian package)
libevent (Red Hat package)

Install security update from vendor's website.

libevent - update to 2.1.13
libevent - update to 2.1.12-17
libevent-debuginfo - update to 2.1.12-17
libevent-debugsource - update to 2.1.12-17
libevent-devel - update to 2.1.12-17
libevent (Debian package) - update to 2.1.13-stable-1~deb13u1
libevent (Red Hat package) - update to 2.1.13-1.el10_2
libevent - addressed in versions 2.1.13-1.fc43, 2.1.13-1.fc44, 2.1.13-1.fc45

• https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6

• Multiple vulnerabilities in libevent
• openEuler update for libevent
• Fedora 45 update for libevent
• Fedora 44 update for libevent
• Fedora 43 update for libevent
• Debian update for libevent
• Multiple vulnerabilities in IBM i
• Red Hat Enterprise Linux 10 update for libevent