CVE-2026-63385

This CVE presents a dangerous asymmetry that the version number obscures. The CRLF header injection appears properly fixed in libevent 2.1.13. The URI NUL-truncation condition — the same CVE — may not be. The advisory explicitly states that 'the reviewed patches do not clearly remediate' this issue. That phrasing should concern you more than a clean fix would. If you're a defender seeing 'CVE-2026-63385, fixed in 2.1.13' and updating your dependency, you may have mitigated one vulnerability while leaving another active under the same identifier. The issue is in evhttp_decode_uri_internal — whether that function was actually touched in the patch is unclear from public disclosure. When a decoded URI containing a NUL byte gets silently truncated during percent-decoding, downstream code receives a path that does not represent what was actually requested, with no error signal. The CVSS 9.2 rating reflects worst-case severity and drives compliance-driven patching. The EPSS of 0.00403 suggests low near-term exploitation probability. This gap creates a specific failure mode: organizations patch to satisfy severity requirements, close the ticket, and become less vigilant precisely when residual uncertainty is highest. You cannot audit your way out of this without commit-level visibility you likely don't have. Treat this as two separate risk surfaces until proven otherwise. Assume the NUL-truncation condition persists unless your specific downstream usage confirms otherwise. If your code receives decoded URIs from libevent, validate the percent-encoded string before decoding, not after — that gap is where exploitation lives. The version number is not the verification; the call-graph diff is.

Reviewed through automated stages and approved by a human before publication.