CVE-2026-63382

Name of the Vulnerable Software and Affected Versions Libevent versions prior to 2.1.13 Libevent versions prior to 2.2.2-alpha

Description The evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. Specifically, the evhttp find header() function may select only the first header, and the evhttp handle chunked read() function uses EVBUFFER EOL CRLF instead of EVBUFFER EOL CRLF STRICT, which allows the acceptance of bare LF chunk terminators. When deployed behind a proxy that frames requests differently, an unauthenticated remote attacker can desynchronize request boundaries to smuggle a second request, which may lead to cache poisoning or the bypassing of access controls.

Recommendations Update to version 2.1.13. Update to version 2.2.2-alpha.