CVE-2026-63379

CVE-2026-63379 reveals a class of vulnerability that HTTP libraries have repeatedly introduced: silent promotion of chunked transfer encoding trailers into application-visible request headers, violating RFC 7230's explicit distinction between headers and trailers. Libevent's http.c was merging trailers into req->input_headers, creating a differential interpretation between what proxies parse and what the application sees. This is not a case of developers writing dangerous code — they were using the API as documented. The semantic violation was invisible at the surface. The practical risk: an attacker controlling an upstream HTTP entity (malicious proxy, compromised intermediary) can inject trailer fields that downstream libevent-based services interpret as routing headers, authentication tokens, or cache keys. The application trusts what looks like a normal header but is actually body metadata that RFC 7230 designates as hop-by-hop and unsuitable for routing decisions. The fix required introducing evhttp_parse_headers_impl_ with a temporary trailer list rather than a simple toggle — indicating trailer-merging was structurally entangled in the parsing pipeline. This complexity is the tell: parsing convenience (treating headers and trailers as the same data structure) optimized for common-case performance became a security failure under adversarial traffic. The same pattern appears in Envoy's CVE-2019-9900/9901 and earlier Apache smuggling bugs. Check your deployments: any libevent-based service handling traffic from untrusted proxies is potentially affected. The vulnerability sits at the foundation layer — one semantic drift in a shared event loop poisons every upstream service. Audit your parsing code for similar trailer-to-header promotion, and treat any HTTP library behavior that diverges from RFC semantics as a compounding exposure risk: the longer it persists, the more downstream code normalizes the violation, and the more expensive remediation becomes.

Reviewed through automated stages and approved by a human before publication.