CVE-2026-63379

Name of the Vulnerable Software and Affected Versions Libevent versions prior to 2.1.13 Libevent versions prior to 2.2.2-alpha

Description An unauthenticated remote attacker can exploit the way chunked HTTP trailers are processed in http.c through the evhttp read trailer() function. The software merges these trailers into request headers, which can lead to discrepancies in how an upstream proxy and the application interpret effective headers. This behavior enables header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The issue occurs because trailers are merged into req->input headers instead of being handled separately.

Recommendations Update to version 2.1.13. Update to version 2.2.2-alpha.