LiveActive security incident?Get immediate response
CVE Record

CVE-2026-63385: Libevent: HTTP header handling bugs create risk of access control bypass.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.

CriticalCVSS 9.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Libevent can interpret certain web requests differently from proxies or application checks. An unauthenticated remote attacker may exploit that mismatch to bypass access controls or inject headers. Risk is highest where affected Libevent HTTP handling protects sensitive, internet-facing services.

Executive priority

Prioritize urgent inventory and remediation for internet-facing or security-sensitive services. Upgrade promptly for the confirmed header fix, but do not close the issue solely on version evidence until the URI NUL condition is clarified and compensating validation is verified.

Technical view

Affected http.c parsing accepts percent-encoded NUL bytes that may truncate paths during C-string processing and obsolete folded headers containing CR/LF. These representation differences can cause path-validation bypass or HTTP header interpretation disagreements. The published releases address CRLF acceptance, but the supplied evidence does not clearly show that they fix NUL truncation.

Likely exposure

Exposure requires Libevent before 2.1.13 or versions from 2.2.0-alpha through before 2.2.2-alpha, plus use of its HTTP parsing on reachable requests. Systems behind proxies, gateways, or path-based authorization controls deserve particular attention. Package presence alone does not prove exploitability.

Exploitation context

No active exploitation is established: the CVE is not listed as KEV, and the source bundle cites no in-the-wild abuse. Exploitation is remotely reachable without privileges or user interaction, but depends on susceptible downstream path handling or disagreement between a proxy and Libevent.

Researcher notes

The central issue is inconsistent request interpretation, classified as CWE-444. CVSS 4.0 is 9.2, with network access, low complexity, no privileges, and no user interaction, although attack requirements are present. Patch review in the supplied bundle leaves the URI NUL-truncation remediation uncertain.

Mitigation direction

  • Upgrade the 2.1 branch to 2.1.13 or the 2.2 alpha branch to 2.2.2-alpha.
  • Treat these upgrades as confirmed remediation for CRLF header acceptance only.
  • Check current Libevent guidance for definitive remediation of the URI NUL-truncation condition.
  • Until clarified, reject percent-encoded NULs before routing, authorization, or path validation.
  • Align proxy and application request-normalization policies, especially for folded or control-character headers.

Validation and detection

  • Inventory direct and transitive Libevent versions in deployed services and appliances.
  • Identify reachable components that use Libevent's evhttp request parsing.
  • Confirm upgraded versions reject CR/LF-containing header values.
  • Verify authorization evaluates the same normalized path used for routing.
  • Test that percent-encoded NULs are rejected before security decisions.
  • Monitor vendor updates to confirm whether URI NUL truncation receives a complete fix.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-444: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-63385 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.2 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.2CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N——GitHub_M

Vulnerability scoring details

Base CVSS 4.0 score

9.2Critical
CVSS 4.0 vector shape for CVE-2026-63385Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
libeventlibevent>= 2.2.0-alpha, < 2.2.2-alpha, < 2.1.13Listed
Weakness

CWE details

CWE-444

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-444 · source CWE mapping

Inconsistent Interpretation of HTTP Requests

Inconsistent Interpretation of HTTP Requests represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs