Quick answers
- Is CVE-2026-63379 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-63379 being exploited in the wild.
- How severe is CVE-2026-63379?
- Informational severity, with a CVSS score of 0, published 20 August 2026.
- Which products and versions are affected?
- Libevent prior to 2.1.13 and 2.2.2-alpha.
- Is there a fix for CVE-2026-63379?
- A patch was published on 2026: Patched in versions 2.1.13 and 2.2.2-alpha Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-63379 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-63379?
- Check whether you run Libevent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Libevent versions prior to 2.1.13 and 2.2.2-alpha incorrectly merge HTTP chunked transfer encoding trailers into the main request header list via the evhttp_read_trailer function in http.c. This violates HTTP specifications and creates a header interpretation mismatch: an upstream proxy and the libevent application may process different effective headers from the same request. An unauthenticated remote attacker can craft a malicious chunked HTTP request with security-sensitive fields in trailers to achieve header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The vulnerability is fixed by parsing trailers into a temporary list and discarding them instead of merging them. Patches are available in versions 2.1.13 and 2.2.2-alpha.
Affected products
- Libevent Libevent prior to 2.1.13 and 2.2.2-alpha
Timeline
- 2026-08-20: disclosed
- 2026: patched: Patched in versions 2.1.13 and 2.2.2-alpha