CVE-2026-63382

{
  "id": "CVE-2026-63382",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-20T18:16:35.700",
  "lastModified": "2026-10-26T10:10:00.140",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."
    },
    {
      "lang": "es",
      "value": "Libevent es una biblioteca de notificación de eventos. Antes de 2.1.13 y 2.2.2-alpha, el analizador evhttp de libevent en http.c maneja de forma inconsistente los encabezados Transfer-Encoding duplicados, los valores Transfer-Encoding separados por comas y los saltos de línea simples en el encuadre fragmentado. evhttp_find_header solo puede seleccionar el primer encabezado, evhttp_check_transfer_encoding_ estaba ausente, por lo que la comparación de cadena completa anterior no reconoce listas válidas que terminan en chunked, y evhttp_handle_chunked_read usa EVBUFFER_EOL_CRLF en lugar de EVBUFFER_EOL_CRLF_STRICT, aceptando terminadores de fragmento LF simples. Cuando libevent se implementa detrás de un proxy que enmarca la misma solicitud de manera diferente, un atacante remoto no autenticado puede desincronizar los límites de la solicitud y contrabandear una segunda solicitud, lo que podría eludir los controles de acceso o envenenar las cachés. Este problema se soluciona en las versiones 2.1.13 y 2.2.2-alpha."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "libevent",
          "product": "libevent",
          "versions": [
            {
              "version": ">= 2.2.0-alpha, < 2.2.2-alpha",
              "status": "affected"
            },
            {
              "version": "< 2.1.13",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.2,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-20T19:33:43.608585Z",
          "id": "CVE-2026-63382",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}