Security readout for executives and security teams
Plain-English summary
A flaw in libevent’s HTTP parser can let an unauthenticated internet attacker hide a second request inside another request when a proxy and backend interpret boundaries differently. Successful abuse could bypass access controls, poison caches, expose data, alter data, or cause limited service disruption.
Executive priority
Treat internet-facing affected deployments as an urgent patching priority. First identify evhttp services behind proxies, then upgrade and validate the deployed binaries. Internal or non-proxied deployments may have lower practical exposure, but the supplied evidence does not justify deferring remediation without confirming architecture and parser use.
Technical view
The evhttp parser inconsistently processes duplicate and comma-separated Transfer-Encoding headers and accepts bare line feeds in chunked framing. These discrepancies can create proxy/backend request-boundary desynchronization and HTTP request smuggling. The issue is CWE-444, scored CVSS 4.0 9.2, and fixed in libevent 2.1.13 and 2.2.2-alpha.
Likely exposure
Exposure requires an application using affected libevent evhttp code, particularly behind a proxy that frames ambiguous HTTP requests differently. Affected versions are below 2.1.13 and 2.2.0-alpha through versions before 2.2.2-alpha. Systems not using evhttp are not established as affected by the supplied evidence.
Exploitation context
The attack is remote, unauthenticated, low complexity, and requires a proxy/backend parsing mismatch. The supplied bundle reports no KEV listing and provides no evidence of active exploitation. Practical impact depends on deployment topology, proxy behavior, routing, caching, and downstream authorization controls.
Researcher notes
The vulnerable behaviors involve first-header selection, failure to recognize Transfer-Encoding lists ending in chunked, and non-strict chunk line termination. Exploitability depends on a front end interpreting the same traffic differently. The bundle identifies four corrective commits, but it does not provide deployment-specific proxy compatibility findings or observed exploitation telemetry.
Mitigation direction
- Upgrade stable deployments to libevent 2.1.13 or later.
- Upgrade 2.2 alpha deployments to 2.2.2-alpha or later.
- Identify applications and appliances that embed affected libevent versions.
- Prioritize internet-facing evhttp services operating behind reverse proxies or caches.
- Consult vendor guidance when libevent is bundled and cannot be upgraded independently.
Validation and detection
- Inventory direct and transitive libevent versions across deployed applications and appliances.
- Confirm whether each affected application uses the evhttp server parser.
- Map reverse proxies, gateways, and caches positioned before affected evhttp services.
- Verify deployed binaries contain the vendor fixes, not merely updated package metadata.
- Review proxy and backend logs for unexplained request-boundary, routing, or cache anomalies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-444: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-63382 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8jCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6eCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/libevent/libevent/releases/tag/release-2.1.13-stableCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/libevent/libevent/releases/tag/release-2.2.2-alphaCVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inconsistent Interpretation of HTTP Requests
Inconsistent Interpretation of HTTP Requests represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.