# CVE-2026-63379: Libevent HTTP chunked trailer header smuggling

Source: https://junglewise.ai/threats/cve-2026-63379-libevent-http-chunked-trailer-header-smuggling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63379 · Severity: info · CVSS 0 · Published 2026-08-20

Libevent is a widely-used event notification library that handles network communication for many applications. An attacker can exploit improper processing of HTTP trailer headers to trick upstream proxies and applications into interpreting different effective headers, potentially bypassing authorization checks, spoofing security-critical headers, poisoning caches, or gaining unauthorized access to protected resources.

Technologies: [Libevent](https://junglewise.ai/threats/technologies/libevent). Vendors: [Libevent](https://junglewise.ai/threats/vendors/libevent).

## Quick answers

**Is CVE-2026-63379 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63379 being exploited in the wild.

**How severe is CVE-2026-63379?** Informational severity, with a CVSS score of 0, published 20 August 2026.

**Which products and versions are affected?** Libevent prior to 2.1.13 and 2.2.2-alpha.

**Is there a fix for CVE-2026-63379?** A patch was published on 2026: Patched in versions 2.1.13 and 2.2.2-alpha Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63379 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63379?** Check whether you run Libevent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Libevent versions prior to 2.1.13 and 2.2.2-alpha incorrectly merge HTTP chunked transfer encoding trailers into the main request header list via the evhttp_read_trailer function in http.c. This violates HTTP specifications and creates a header interpretation mismatch: an upstream proxy and the libevent application may process different effective headers from the same request. An unauthenticated remote attacker can craft a malicious chunked HTTP request with security-sensitive fields in trailers to achieve header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The vulnerability is fixed by parsing trailers into a temporary list and discarding them instead of merging them. Patches are available in versions 2.1.13 and 2.2.2-alpha.

## Affected products

- Libevent Libevent prior to 2.1.13 and 2.2.2-alpha

## Timeline

- 2026-08-20: disclosed
- 2026: patched: Patched in versions 2.1.13 and 2.2.2-alpha

## References

- [https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636](https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636)
- [https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485](https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485)

## Related threats

- [Libevent WebSocket unbounded memory accumulation via frame fragmentation](https://junglewise.ai/threats/cve-2026-63495-libevent-websocket-unbounded-memory-accumulation-via-frame)
- [Libevent heap out-of-bounds write in bufferevent_sock](https://junglewise.ai/threats/cve-2026-63388-libevent-heap-out-of-bounds-write-in-bufferevent-sock)
- [Libevent off-by-one stack buffer overflow in DNS response parsing](https://junglewise.ai/threats/cve-2026-63387-libevent-off-by-one-stack-buffer-overflow-in-dns-response-parsing)
- [Libevent integer overflow in evtag_unmarshal_header](https://junglewise.ai/threats/cve-2026-63384-libevent-integer-overflow-in-evtag-unmarshal-header)
- [Libevent out-of-bounds read in event_tagging](https://junglewise.ai/threats/cve-2026-63383-libevent-out-of-bounds-read-in-event-tagging)