libevent evhttp CVE-2024-6382 HTTP Request Smuggling Vulnerability Analysis

Vulnerability Overview Vulnerability Name: libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling CVE ID: CVE-2024-6382 Severity: High Description: The HTTP parser in libevent contains three vulnerabilities related to handling and chunked body parsing. These flaws cause a discrepancy in body framing between the parser and reverse proxies, enabling HTTP request smuggling. Affected Scope Affected Components: - Library: libevent (evhttp) - Files: - — returns the first match (Bug 1) - — appends without duplicate checking (Bug 1) - — performs exact matching (Bug 2) - — accepts as a line terminator (Bug 3) - Version: Tested against the latest main branch (git HEAD) Deployment Context: - libevent is an event notification library, and its embedded HTTP server (evhttp) is widely used in various applications, ranging from caching layers (memcached) to custom microservices in network infrastructure (Tor). The library authors cannot predict or control the environment in which their code is ultimately deployed. In environments where services may be located behind CDNs, cloud load balancers, NGINX-HA fallback proxies, home network reverse proxies, or any combination of middleware, HTTP parsing discrepancies become directly exploitable. The HTTP ecosystem is too diverse and rapidly changing to assume that middleware will not interpret these headers or bytes differently. Remediation Bug 1: Duplicate Transfer-Encoding First-Wins RFC Violation: RFC 9110 states that recipients must not silently select among multiple header fields with the same name unless that field is defined as a comma-separated list. Multiple headers with different values indicate a malformed message that must be rejected or combined. Root Cause: unconditionally appends headers to the TAILQ without duplicate checking. Remediation Advice: 1. Reject duplicate TE headers: If multiple headers exist, return 400 Bad Request. 2. Alternatively, merge multiple TE values into a comma-separated list according to RFC 9110 Section 5.3. Bug 2: Multi-Value Transfer-Encoding Ignored RFC Violation: RFC 9112 specifies that if any transfer coding applied to a request payload is not chunked, the sender must use chunked as the final transfer coding. Compliant parsers must tokenize comma-separated TE values and identify as the final encoding. Root Cause: TE comparison uses —a full-string case-insensitive comparison. There is no tokenization by comma, nor whitespace trimming for individual tokens. Remediation Advice: 1. Tokenize comma-separated TE values: Split by comma and check each token individually. 2. Identify as the final encoding: Enable chunked decoding if appears as the last token. 3. Reject unknown transfer codings: Return 501 Not Implemented unless is the final encoding. Bug 3: Bare LF Accepted in Chunked Transfer Encoding RFC Violation: RFC 9112 strictly requires CRLF ( ) as the line terminator in all chunked encodings. While RFC 9112 allows relaxing bare LF acceptance in header parsing, this relaxation does not apply to chunked body framing. Root Cause: Chunk size parsing in uses to read lines. Remediation Advice: 1. Use for chunk parsing: libevent already has a strict CRLF mode that requires both and . Switch the chunk line reading in from to . All Vulnerabilities Reject CL + Non-Chunked TE: Return 400 Bad Request when both Content-Length and non-chunked Transfer-Encoding are present simultaneously. POC Code Bug 1: Duplicate TE Bug 2: Multi-Value TE Bug 3: Bare LF Chunk Exploitation: CL.TE Request Smuggling End-to-End Smuggling PoC Impact ACL Bypass: Proxies blocking never see the smuggled request—it is invisible at the proxy layer. Credential Theft: Smuggled requests access protected endpoints and return sensitive data. Cache Poisoning: Smuggled responses can poison cache entries for other users. Session Hijacking: In shared connection deployments, smuggled requests can be attached to the next client's request. Reproduction Prerequisites Run All PoCs References RFC 9110 Section 7.2 — Duplicate Header Fields RFC 9112 Section 4 — Transfer Coding RFC 9112 Section 6.1 — Transfer-Encoding Priority RFC 9112 Section 7.1 — Chunked Transfer Coding RFC 9112 Section 11.2 — Request Smuggling CVE-2024-52304 — AIOHTTP bare LF in chunks CVE-2025-22671 — Go nethttp bare LF in chunks CVE-2024-53868 — Apache Traffic Server — TERM behavior in chunk parsing PortSwigger — HTTP Request Smuggling — Comprehensive CL.TE and TE.CL smuggling reference James Kettle — HTTP Desync Attacks — Original research on modern HTTP request smuggling James Kettle — HTTP2: The Sequel is Always Worse — Research covering TE parsing differences across implementations

Goal Reached Thanks to every supporter — we hit 100%!

libevent evhttp CVE-2024-6382 HTTP Request Smuggling Vulnerability Analysis

More from this source