CVE-2026-63379

A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP (Hypertext Transfer Protocol) trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers, causing an upstream proxy and the Libevent application to interpret different effective headers. This can lead to header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning.

Red Hat ships libevent in multiple products including Red Hat Enterprise Linux, RHIVOS, and as part of RHCOS in OpenShift. All shipped versions are prior to the fix in 2.1.13 and are affected by this vulnerability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.