CVE-2026-63385: 
MySQL vulnerability analysis and mitigation

CVE-2026-63385 is an HTTP parsing vulnerability in libevent (an event notification library) that enables access control bypass via two distinct weaknesses in http.c. The first weakness causes evhttp_decode_uri_internal to decode percent-encoded %00 bytes into literal NUL characters, allowing path truncation that bypasses validation logic. The second weakness causes evhttp_header_is_valid_value to accept obsolete HTTP obs-fold (CRLF followed by SP/HT), enabling header injection in proxy chains. Affected versions are libevent < 2.1.12 and 2.2.0-alpha through 2.2.1-alpha. It was disclosed on July 1, 2026, and carries a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, Feedly).

The vulnerability is classified as CWE-444 (Inconsistent Interpretation of HTTP Requests / HTTP Request Smuggling). The NUL-truncation bug resides in evhttp_decode_uri_internal (http.c, lines 3536–3554), where %00 is decoded to a literal NUL byte written to the output buffer without rejection; downstream C string functions (strcmp, strlen, fopen) then truncate the path at the NUL, causing a mismatch between the validated and served path. A proof-of-concept request GET /admin/secret%00.jpg HTTP/1.1 demonstrates how an extension check sees .jpg (allowed) while libevent serves /admin/secret (restricted). The obs-fold bug in evhttp_header_is_valid_value (http.c, lines 2124–2130) previously allowed CRLF-followed-by-whitespace sequences in header values, creating a header injection vector in proxy chains where the frontend rejects obs-fold but libevent's backend accepts it (GitHub Advisory, Commit 758be0c).

Successful exploitation of the NUL-truncation bug allows unauthenticated remote attackers to bypass path-based access controls, potentially accessing restricted resources (e.g., administrative endpoints or sensitive files) that should be protected. The obs-fold header injection weakness enables attackers to manipulate HTTP headers in proxy-to-backend communication, potentially bypassing authentication, poisoning caches, or performing request smuggling attacks. The CVSS v4.0 scoring reflects high confidentiality and integrity impact, with low availability impact; notably, the NUL-truncation condition is not fully remediated by the reviewed patches (GitHub Advisory, Feedly).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.40%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. NVD SSVC assessment classifies exploitation as "none" and the technical impact as "partial." The attack requires no privileges or user interaction but does require specific attack conditions (AT:P), such as a proxy chain where the frontend and backend interpret HTTP differently (Feedly).

1. Reconnaissance: Identify applications or services using libevent versions ≤ 2.1.12 or 2.2.0-alpha through 2.2.1-alpha as their HTTP backend, particularly those deployed behind a reverse proxy.
2. NUL-truncation path bypass: Craft an HTTP request with a percent-encoded NUL byte in the URI path, e.g., GET /admin/secret%00.jpg HTTP/1.1. The proxy or validation layer sees /admin/secret%00.jpg (with an allowed .jpg extension), while libevent decodes %00 to a NUL byte and C string operations truncate the path to /admin/secret, serving the restricted resource.
3. Obs-fold header injection: In a proxy chain where the frontend rejects obs-fold but libevent's backend accepts it, craft a request with a header value containing CRLF followed by a space or tab, e.g., X-Custom-Header: value\r\n injected-header: malicious. The frontend passes the request while libevent interprets the folded line as a continuation, allowing injection of arbitrary headers into the backend context.
4. Access restricted resources or bypass controls: Use the injected or truncated path to access protected endpoints, escalate privileges, or manipulate backend logic depending on the application's access control implementation (GitHub Advisory).

• Network: HTTP requests to protected paths containing %00 in the URI (e.g., /admin/secret%00.jpg); HTTP requests with header values containing literal \r\n followed by whitespace (obs-fold sequences) in proxy traffic.
• Logs: Web server or application access logs showing requests with %00 in the URL path that result in successful (2xx) responses to normally restricted resources; anomalous header fields appearing in backend logs that were not present in frontend/proxy logs.
• Process/Application: Unexpected access to restricted files or endpoints by unauthenticated clients; discrepancies between frontend proxy logs and libevent backend logs for the same request (different path or header interpretation).

Upgrade libevent to version 2.1.13-stable or 2.2.2-alpha, both released on July 1, 2026, which fix the obs-fold CRLF header acceptance issue. Note that the NUL-truncation (%00 URI decoding) condition is not clearly remediated by the reviewed patches, so additional application-level validation rejecting URIs containing %00 is strongly recommended. As a workaround, configure upstream proxies or WAFs to reject requests containing %00 in URI paths and to strip or reject obs-fold header values before forwarding to libevent backends. Downstream Linux distributions including Ubuntu (USN-8710-1) and Mageia have issued updated packages (GitHub Release 2.1.13, GitHub Release 2.2.2-alpha, GitHub Advisory).

The vulnerability was reported by security researcher AsafMeizner through differential analysis comparing libevent and libwebsockets HTTP implementations, and was acknowledged and patched by libevent maintainer nmathewson. The advisory notes that the NUL-truncation condition is not clearly remediated by the released patches, which may prompt further community scrutiny. The Yocto Project security mailing list and multiple Linux distribution security teams (Ubuntu, Mageia, Debian) have tracked and issued advisories for this CVE, reflecting broad downstream impact on embedded and server deployments (GitHub Advisory, Ubuntu Advisory).