CVE-2026-63382

🗓️ 20 Aug 2026 17:51:15Reported by Debian Security Bug TrackerType

debiancve🔗 security-tracker.debian.org👁 9 Views

HTTP request smuggling in libevent evhttp parser via inconsistent Transfer-Encoding header handling.

Reporter	Title	Published	Views	Family All 45
BDU FSTEC	The vulnerability of the evhttp_find_header() function in the evhttp HTTP parser library from the asynchronous event notification library Libevent allows a attacker to cause a service failure.	26 Aug 202600:00	–	bdu_fstec
CBLMariner	CVE-2026-63382 affecting package libevent for versions less than 2.1.13-1	2 Sep 202620:43	–	cbl_mariner
CBLMariner	CVE-2026-63382 affecting package mysql for versions less than 8.0.46-2	2 Sep 202620:43	–	cbl_mariner
CBLMariner	CVE-2026-63382 affecting package ntp for versions less than 4.2.8p17-3	2 Sep 202620:43	–	cbl_mariner
Circl	CVE-2026-63382	20 Aug 202619:40	–	circl
CVE	CVE-2026-63382	20 Aug 202617:51	–	cve
Cvelist	CVE-2026-63382 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling	20 Aug 202617:51	–	cvelist
Debian	[SECURITY] [DSA 6493-1] libevent security update	11 Sep 202607:03	–	debian
Tenable Nessus	Debian dsa-6493 : libevent-2.1-7t64 - security update	11 Sep 202600:00	–	nessus
Tenable Nessus	Fedora 43 : libevent (2026-728dd9f704)	11 Sep 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	12	all	libevent	2.1.12-stable-8	libevent_2.1.12-stable-8_all.deb
Debian	13	all	libevent	2.1.13-stable-1~deb13u1	libevent_2.1.13-stable-1~deb13u1_all.deb
Debian	14	all	libevent	2.1.13-stable-1	libevent_2.1.13-stable-1_all.deb
Debian	999	all	libevent	2.1.13-stable-1	libevent_2.1.13-stable-1_all.deb

20 Aug 2026 17:51Current

5.5Medium risk

Vulners AI Score5.5

CVSS 49.2

EPSS0.00587

SSVC

libevent HTTP request smuggling Transfer-Encoding chunked framing CRLF parsing access control bypass cache poisoning