Vulnerability-Lookup

CVE-2026-63382 (GCVE-0-2026-63382)

Vulnerability from cvelistv5 – Published: 2026-08-20 17:51 – Updated: 2026-08-20 19:33

Title

libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

Summary

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 19:33 UTC

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7763 records in the last 180 days details

References

7 references

URL	Tags
https://github.com/libevent/libevent/security/adv…	x_refsource_CONFIRM
https://github.com/libevent/libevent/commit/10abb…	x_refsource_MISC
https://github.com/libevent/libevent/commit/5119c…	x_refsource_MISC
https://github.com/libevent/libevent/commit/83ba6…	x_refsource_MISC
https://github.com/libevent/libevent/commit/ac387…	x_refsource_MISC
https://github.com/libevent/libevent/releases/tag…	x_refsource_MISC
https://github.com/libevent/libevent/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
libevent	libevent	Affected: >= 2.2.0-alpha, < 2.2.2-alpha Affected: < 2.1.13	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63382",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T19:33:43.608585Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T19:33:50.217Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "libevent",
          "vendor": "libevent",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.2.0-alpha, \u003c 2.2.2-alpha"
            },
            {
              "status": "affected",
              "version": "\u003c 2.1.13"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T17:51:15.156Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"
        },
        {
          "name": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6"
        },
        {
          "name": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e"
        },
        {
          "name": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660"
        },
        {
          "name": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0"
        },
        {
          "name": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
        },
        {
          "name": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
        }
      ],
      "source": {
        "advisory": "GHSA-q39v-w2g7-gr8j",
        "discovery": "UNKNOWN"
      },
      "title": "libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63382",
    "datePublished": "2026-08-20T17:51:15.156Z",
    "dateReserved": "2026-07-16T17:39:30.171Z",
    "dateUpdated": "2026-08-20T19:33:50.217Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63382",
      "date": "2026-11-11",
      "epss": "0.01991",
      "percentile": "0.80927"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "libevent",
                "vendor": "libevent",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.2.0-alpha, \u003c 2.2.2-alpha"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 2.1.13"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."
          },
          {
            "lang": "es",
            "value": "Libevent es una biblioteca de notificaci\u00f3n de eventos. Antes de 2.1.13 y 2.2.2-alpha, el analizador evhttp de libevent en http.c maneja de forma inconsistente los encabezados Transfer-Encoding duplicados, los valores Transfer-Encoding separados por comas y los saltos de l\u00ednea simples en el encuadre fragmentado. evhttp_find_header solo puede seleccionar el primer encabezado, evhttp_check_transfer_encoding_ estaba ausente, por lo que la comparaci\u00f3n de cadena completa anterior no reconoce listas v\u00e1lidas que terminan en chunked, y evhttp_handle_chunked_read usa EVBUFFER_EOL_CRLF en lugar de EVBUFFER_EOL_CRLF_STRICT, aceptando terminadores de fragmento LF simples. Cuando libevent se implementa detr\u00e1s de un proxy que enmarca la misma solicitud de manera diferente, un atacante remoto no autenticado puede desincronizar los l\u00edmites de la solicitud y contrabandear una segunda solicitud, lo que podr\u00eda eludir los controles de acceso o envenenar las cach\u00e9s. Este problema se soluciona en las versiones 2.1.13 y 2.2.2-alpha."
          }
        ],
        "id": "CVE-2026-63382",
        "lastModified": "2026-10-26T10:10:00.140",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.2,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-63382",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T19:33:43.608585Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-20T18:16:35.700",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-444"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-06T06:33:50+00:00",
      "cve": "CVE-2026-63382",
      "id": "CVE-2026-63382",
      "initial_release_date": "2026-08-20T17:51:15.156000+00:00",
      "product_status:fixed": "134",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63382.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-63382",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-20T19:33:43.608585Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-20T19:33:25.067Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "libevent",
              "vendor": "libevent",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.2.0-alpha, \u003c 2.2.2-alpha"
                },
                {
                  "status": "affected",
                  "version": "\u003c 2.1.13"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 9.2,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "LOW",
                "subIntegrityImpact": "LOW",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-444",
                  "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-20T17:51:15.156Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"
            },
            {
              "name": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6"
            },
            {
              "name": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e"
            },
            {
              "name": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660"
            },
            {
              "name": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0"
            },
            {
              "name": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
            },
            {
              "name": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
            }
          ],
          "source": {
            "advisory": "GHSA-q39v-w2g7-gr8j",
            "discovery": "UNKNOWN"
          },
          "title": "libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-63382",
        "datePublished": "2026-08-20T17:51:15.156Z",
        "dateReserved": "2026-07-16T17:39:30.171Z",
        "dateUpdated": "2026-08-20T19:33:50.217Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-63382

Vulnerability from fkie_nvd - Published: 2026-08-20 18:16 - Updated: 2026-10-26 10:10

Severity

9.2 (Critical) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6
	security-advisories@github.com	https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e
	security-advisories@github.com	https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660
	security-advisories@github.com	https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0
	security-advisories@github.com	https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
	security-advisories@github.com	https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	security-advisories@github.com	https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "libevent",
          "vendor": "libevent",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.2.0-alpha, \u003c 2.2.2-alpha"
            },
            {
              "status": "affected",
              "version": "\u003c 2.1.13"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."
    },
    {
      "lang": "es",
      "value": "Libevent es una biblioteca de notificaci\u00f3n de eventos. Antes de 2.1.13 y 2.2.2-alpha, el analizador evhttp de libevent en http.c maneja de forma inconsistente los encabezados Transfer-Encoding duplicados, los valores Transfer-Encoding separados por comas y los saltos de l\u00ednea simples en el encuadre fragmentado. evhttp_find_header solo puede seleccionar el primer encabezado, evhttp_check_transfer_encoding_ estaba ausente, por lo que la comparaci\u00f3n de cadena completa anterior no reconoce listas v\u00e1lidas que terminan en chunked, y evhttp_handle_chunked_read usa EVBUFFER_EOL_CRLF en lugar de EVBUFFER_EOL_CRLF_STRICT, aceptando terminadores de fragmento LF simples. Cuando libevent se implementa detr\u00e1s de un proxy que enmarca la misma solicitud de manera diferente, un atacante remoto no autenticado puede desincronizar los l\u00edmites de la solicitud y contrabandear una segunda solicitud, lo que podr\u00eda eludir los controles de acceso o envenenar las cach\u00e9s. Este problema se soluciona en las versiones 2.1.13 y 2.2.2-alpha."
    }
  ],
  "id": "CVE-2026-63382",
  "lastModified": "2026-10-26T10:10:00.140",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.2,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63382",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-20T19:33:43.608585Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-20T18:16:35.700",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GCVE-1988-2026-0383

Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57

Title

[Bugtraq] [SECURITY] [DSA 6493-1] libevent security update

Summary

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6493-1 security@debian.org https://www.debian.org/security/ Aron Xu September 11, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libevent CVE ID : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383 CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388 Several vulnerabilities were discovered in libevent, an asynchronous event notification library. The HTTP implementation (evhttp) handled Transfer-Encoding and Content-Length headers, chunked-encoding line terminators, header line folding and chunked trailers too permissively, which could allow HTTP request smuggling, header injection or access control bypass when a libevent-based server or client is combined with an HTTP proxy. Out-of-bounds memory accesses in the DNS (evdns), tagged RPC (evtag/evrpc) and buffered socket (bufferevent) code, and a use-after-free in evbuffer, could result in denial of service or potentially the execution of arbitrary code when processing untrusted input. For the stable distribution (trixie), these problems have been fixed in version 2.1.13-stable-1~deb13u1. We recommend that you upgrade your libevent packages. For the detailed security status of libevent please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libevent Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqjpDsACgkQ+GQ1dHE8 m66UlwgAgrC5PETAeCcPs0IWznLVphNNUlMHpLO1mxWas+PVMSdyu6cN7iddjSc9 dfwwlb2Oy+kaa8h0EjLmQP4pywP/8115uzFdQ4b0/xUsPzJTgQrPT8ivp55kYLso JrHqcIGTOqenaFRJL81XdZrgw/dqnnYBkDBc1nzTfdDuNPaDZ63uw1e1YhEwdtqg Bcmn3Rvkvn32ehpEOO5GZIHvjr87agMtLrlhlUVDd+FmNqP5dI0D0uMZIPEMmr/V oy7hppI93rnNG4iEU/zFVoFK5pwwgo085TraLuPWVUsZ5t4uYMYVDSalFiCsvKaI LJsdek7rIHT7j2nlMwNwlJzVgepB8g== =S+60 -----END PGP SIGNATURE-----

Severity

No CVSS data available.

Assigner

VULNARCHIVE GNA GNA-1988

GNA scorecard E 38/100 over 556 records in the last 180 days details

References

5 references

URL	Tags
https://vuln.freearchive.org/archive/item/8737c39…	technical-description
https://lists.securityfocus.com/hyperkitty/list/b…	technical-description
https://security-tracker.debian.org/tracker/libevent
https://www.debian.org/security/
https://www.debian.org/security/faq

Impacted products

1 product

Vendor	Product	Version
unknown	libevent security update	Affected: unknown

Credits

Aron Xu

Relationships

reference GCVE-1988-2026-0383 (this record)

related CVE-2026-63379
related CVE-2026-63381
related CVE-2026-63382
related CVE-2026-63383
related CVE-2026-63384
related CVE-2026-63385
related CVE-2026-63387
related CVE-2026-63388

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "libevent security update",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aron Xu"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-6493-1                   security@debian.org\nhttps://www.debian.org/security/                                  Aron Xu\nSeptember 11, 2026                    https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\nPackage        : libevent\nCVE ID         : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383\nCVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388\nSeveral vulnerabilities were discovered in libevent, an asynchronous event\nnotification library.\nThe HTTP implementation (evhttp) handled Transfer-Encoding and\nContent-Length headers, chunked-encoding line terminators, header line\nfolding and chunked trailers too permissively, which could allow HTTP\nrequest smuggling, header injection or access control bypass when a\nlibevent-based server or client is combined with an HTTP proxy.\nOut-of-bounds memory accesses in the DNS (evdns), tagged RPC\n(evtag/evrpc) and buffered socket (bufferevent) code, and a\nuse-after-free in evbuffer, could result in denial of service or\npotentially the execution of arbitrary code when processing untrusted\ninput.\nFor the stable distribution (trixie), these problems have been fixed in\nversion 2.1.13-stable-1~deb13u1.\nWe recommend that you upgrade your libevent packages.\nFor the detailed security status of libevent please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/libevent\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\niQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqjpDsACgkQ+GQ1dHE8\nm66UlwgAgrC5PETAeCcPs0IWznLVphNNUlMHpLO1mxWas+PVMSdyu6cN7iddjSc9\ndfwwlb2Oy+kaa8h0EjLmQP4pywP/8115uzFdQ4b0/xUsPzJTgQrPT8ivp55kYLso\nJrHqcIGTOqenaFRJL81XdZrgw/dqnnYBkDBc1nzTfdDuNPaDZ63uw1e1YhEwdtqg\nBcmn3Rvkvn32ehpEOO5GZIHvjr87agMtLrlhlUVDd+FmNqP5dI0D0uMZIPEMmr/V\noy7hppI93rnNG4iEU/zFVoFK5pwwgo085TraLuPWVUsZ5t4uYMYVDSalFiCsvKaI\nLJsdek7rIHT7j2nlMwNwlJzVgepB8g==\n=S+60\n-----END PGP SIGNATURE-----"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:24Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/item/8737c3999f8a964d5de05d33cd726d3be47dff5c69758623ccfc5c81df4b7360"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/KOKQZ3SY56BZ4QDICBLX5MBVSDEDOZZ4/"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/libevent"
        },
        {
          "url": "https://www.debian.org/security/"
        },
        {
          "url": "https://www.debian.org/security/faq"
        }
      ],
      "source": {
        "defect": [
          "E1x4vIc-0000000DNFW-2gNP%40seger.debian.org"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[Bugtraq] [SECURITY] [DSA 6493-1] libevent security update",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-63379",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63381",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63382",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63383",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63384",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63385",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63387",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63388",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0383",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/item/8737c3999f8a964d5de05d33cd726d3be47dff5c69758623ccfc5c81df4b7360",
            "automated": true,
            "contentSha256": "8737c3999f8a964d5de05d33cd726d3be47dff5c69758623ccfc5c81df4b7360",
            "evidenceScore": 7,
            "messageId": "E1x4vIc-0000000DNFW-2gNP%40seger.debian.org",
            "originalUrl": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/KOKQZ3SY56BZ4QDICBLX5MBVSDEDOZZ4/",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-02T04:57:24Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0383"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:24Z",
    "dateUpdated": "2026-10-02T04:57:24Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0383"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

OESA-2026-3268 (CVE-2026-63379)

Vulnerability from osv_openeuler – Published: 2026-08-07 02:42 – Updated: 2026-08-07 02:42 – Source website

Summary

libevent security update

Details

Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor.

Security Fix(es):

The updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)

The updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)

The updated packages fix some security vulnerabilities.(CVE-2026-63382)

The updated packages fix some security vulnerabilities.(CVE-2026-63383)

The updated packages fix some security vulnerabilities.(CVE-2026-63384)

The updated packages fix some security vulnerabilities.(CVE-2026-63385)

The updated packages fix some security vulnerabilities.(CVE-2026-63387)

The updated packages fix some security vulnerabilities.(CVE-2026-63388)

Severity

8.4 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63379	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63381	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63382	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63383	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63384	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63385	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63387	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-63388	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libevent-2.1.12-17.oe2403sp4.aarch64.rpm",
          "libevent-debuginfo-2.1.12-17.oe2403sp4.aarch64.rpm",
          "libevent-debugsource-2.1.12-17.oe2403sp4.aarch64.rpm",
          "libevent-devel-2.1.12-17.oe2403sp4.aarch64.rpm"
        ],
        "src": [
          "libevent-2.1.12-17.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "libevent-2.1.12-17.oe2403sp4.x86_64.rpm",
          "libevent-debuginfo-2.1.12-17.oe2403sp4.x86_64.rpm",
          "libevent-debugsource-2.1.12-17.oe2403sp4.x86_64.rpm",
          "libevent-devel-2.1.12-17.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "libevent",
        "purl": "pkg:rpm/openEuler/libevent\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.12-17.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "libevent-2.1.12-7.oe2003sp4.aarch64.rpm",
          "libevent-debuginfo-2.1.12-7.oe2003sp4.aarch64.rpm",
          "libevent-debugsource-2.1.12-7.oe2003sp4.aarch64.rpm",
          "libevent-devel-2.1.12-7.oe2003sp4.aarch64.rpm"
        ],
        "src": [
          "libevent-2.1.12-7.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "libevent-2.1.12-7.oe2003sp4.x86_64.rpm",
          "libevent-debuginfo-2.1.12-7.oe2003sp4.x86_64.rpm",
          "libevent-debugsource-2.1.12-7.oe2003sp4.x86_64.rpm",
          "libevent-devel-2.1.12-7.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "libevent",
        "purl": "pkg:rpm/openEuler/libevent\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.12-7.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "libevent-2.1.12-11.oe2203sp4.aarch64.rpm",
          "libevent-debuginfo-2.1.12-11.oe2203sp4.aarch64.rpm",
          "libevent-debugsource-2.1.12-11.oe2203sp4.aarch64.rpm",
          "libevent-devel-2.1.12-11.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "libevent-2.1.12-11.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "libevent-2.1.12-11.oe2203sp4.x86_64.rpm",
          "libevent-debuginfo-2.1.12-11.oe2203sp4.x86_64.rpm",
          "libevent-debugsource-2.1.12-11.oe2203sp4.x86_64.rpm",
          "libevent-devel-2.1.12-11.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "libevent",
        "purl": "pkg:rpm/openEuler/libevent\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.12-11.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "libevent-2.1.12-17.oe2403sp1.aarch64.rpm",
          "libevent-debuginfo-2.1.12-17.oe2403sp1.aarch64.rpm",
          "libevent-debugsource-2.1.12-17.oe2403sp1.aarch64.rpm",
          "libevent-devel-2.1.12-17.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "libevent-2.1.12-17.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "libevent-2.1.12-17.oe2403sp1.x86_64.rpm",
          "libevent-debuginfo-2.1.12-17.oe2403sp1.x86_64.rpm",
          "libevent-debugsource-2.1.12-17.oe2403sp1.x86_64.rpm",
          "libevent-devel-2.1.12-17.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "libevent",
        "purl": "pkg:rpm/openEuler/libevent\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.12-17.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "libevent-2.1.12-17.oe2403sp3.aarch64.rpm",
          "libevent-debuginfo-2.1.12-17.oe2403sp3.aarch64.rpm",
          "libevent-debugsource-2.1.12-17.oe2403sp3.aarch64.rpm",
          "libevent-devel-2.1.12-17.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "libevent-2.1.12-17.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "libevent-2.1.12-17.oe2403sp3.x86_64.rpm",
          "libevent-debuginfo-2.1.12-17.oe2403sp3.x86_64.rpm",
          "libevent-debugsource-2.1.12-17.oe2403sp3.x86_64.rpm",
          "libevent-devel-2.1.12-17.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "libevent",
        "purl": "pkg:rpm/openEuler/libevent\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.12-17.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor.\r\n\r\nSecurity Fix(es):\n\nThe updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)\n\nThe updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63382)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63383)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63384)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63385)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63387)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63388)",
  "id": "OESA-2026-3268",
  "modified": "2026-08-07T02:42:54Z",
  "published": "2026-08-07T02:42:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3268"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63379"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63381"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63382"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63383"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63384"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63385"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63387"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63388"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libevent security update",
  "upstream": [
    "CVE-2026-63379",
    "CVE-2026-63381",
    "CVE-2026-63382",
    "CVE-2026-63383",
    "CVE-2026-63384",
    "CVE-2026-63385",
    "CVE-2026-63387",
    "CVE-2026-63388"
  ]
}

OPENSUSE-SU-2026:12330-1

Vulnerability from csaf_opensuse - Published: 2026-10-28 00:00 - Updated: 2026-10-29 18:23

Summary

libevent-2_1-7-2.1.13-1.1 on GA media

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2026-63382.

CVE-2026-63382

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Recommended: 16 products

Open the full advisory

RHSA-2026:63388

Vulnerability from csaf_redhat - Published: 2026-09-03 22:19 - Updated: 2026-11-07 05:58

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2026-63382.

CVE-2026-63382

A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successful exploitation could lead to request smuggling, potentially bypassing access controls or poisoning caches.

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Fixed: 7 products

https://access.redhat.com/errata/RHSA-2026:63388

Open the full advisory

RHSA-2026:67908

Vulnerability from csaf_redhat - Published: 2026-09-16 12:30 - Updated: 2026-11-06 07:47

Summary

Red Hat Security Advisory: libevent security update

Severity

Important

Scope

6 vulnerabilities in this advisory, including CVE-2026-63382.

CVE-2026-63382

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Fixed: 32 products

https://access.redhat.com/errata/RHSA-2026:67908

Open the full advisory

RHSA-2026:67909

Vulnerability from csaf_redhat - Published: 2026-09-16 12:36 - Updated: 2026-11-06 07:47

Summary

Red Hat Security Advisory: libevent security update

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-63382.

CVE-2026-63382

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Fixed: 26 products

https://access.redhat.com/errata/RHSA-2026:67909

Open the full advisory

RHSA-2026:67910

Vulnerability from csaf_redhat - Published: 2026-09-16 13:48 - Updated: 2026-11-06 07:47

Summary

Red Hat Security Advisory: libevent security update

Severity

Important

Scope

8 vulnerabilities in this advisory, including CVE-2026-63382.

CVE-2026-63382

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Fixed: 32 products

https://access.redhat.com/errata/RHSA-2026:67910

Open the full advisory

RHSA-2026:71603

Vulnerability from csaf_redhat - Published: 2026-09-24 11:59 - Updated: 2026-11-11 12:57

Summary

Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 security update

Severity

Important

Scope

52 vulnerabilities in this advisory, including CVE-2026-63382.

CVE-2026-63382

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Fixed: 5 products

https://access.redhat.com/errata/RHSA-2026:71603

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-63382 (GCVE-0-2026-63382)

OESA-2026-3268 (CVE-2026-63379)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour