Libevent: HTTP Header smuggling
Priority LOW 35CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 7 fixed, 5 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00518 44th percentileScored 2026-11-07
Fix Partial libevent (libevent): 2.1.13, 2.2.2-alphaRed Hat: 10 advisoriesRed Hat: 7 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA libevent (libevent) Fixed in 2.1.13, 2.2.2-alpha
Red Hat 10 advisories
- RHSA-2026:72476 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
- RHSA-2026:72470 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
Show 7 more Red Hat advisories
- RHSA-2026:72399 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
- RHSA-2026:72394 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:71603 Released 2026-09-24 · Red Hat rating ImportantRed Hat Update Infrastructure 5.3 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
- RHSA-2026:67910 Released 2026-09-16 · Red Hat rating Importantlibevent security update
- Red Hat Enterprise Linux AppStream (v. 9) libevent-devel-2.1.13-1.el9_8, libevent-doc-2.1.13-1.el9_8
- Red Hat Enterprise Linux BaseOS (v. 9) libevent-2.1.13-1.el9_8
- RHSA-2026:67909 Released 2026-09-16 · Red Hat rating Importantlibevent security update
- Red Hat Enterprise Linux AppStream (v. 10) libevent-devel-2.1.13-1.el10_2, libevent-doc-2.1.13-1.el10_2
- Red Hat Enterprise Linux BaseOS (v. 10) libevent-2.1.13-1.el10_2
- RHSA-2026:60853 Released 2026-08-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images libevent-2.1.12-19.1.hum1@aarch64, libevent-2.1.12-19.1.hum1@src, libevent-2.1.12-19.1.hum1@x86_64 +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Cert Manager support for Red Hat OpenShift release 1.20 | Fixed | RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:67909 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:67910 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:67909 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:67910 |
| Red Hat Hardened Images | Fixed | RHSA-2026:60853 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:71603 |
Not affected: 2 products
- Cert Manager support for Red Hat OpenShift release 1.20
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63379
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-07 EPSS moved to the below the 50th percentile
References
Other 5
- https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6
- https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636
- https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485
- https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
- https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
More libevent vulnerabilities
- TI-2026-45182 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling CVSS 4.0CRITICAL 9.2
- TI-2026-45184 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value. CVSS 4.0HIGH 8.7
- TI-2026-45183 Libevent: decode_tag_internal() can lead to out-of-bounds read CVSS 4.0HIGH 8.7
- TI-2026-45237 Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames CVSS 3.1HIGH 7.5
- TI-2026-45187 Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response CVSS 3.1HIGH 7.0
- TI-2026-45180 Libevent: Null Pointer Dereference in `evws_new_session` CVSS 4.0MEDIUM 5.7
Sources
- CVE-2026-63379 · CVE Program
- CVE-2026-63379 · NVD
- FIRST EPSS
- CVE-2026-63379 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences