CVE-2026-63383
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Libevent prior to 2.1.13 and 2.2.2-alpha can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Risk Assessment
An attacker can send malformed tagged RPC data, causing an out-of-bounds read and process crash, leading to denial of service.
Recommendation
Update Libevent to version 2.1.13 or 2.2.2-alpha, which contain the fix. Restrict access to services using tagged RPC data to trusted clients only.
Other vulnerabilities in Libevent
See all- CVE-2016-10197High
The search_make_new function in evdns.c in libevent before version 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname.
- CVE-2016-10196High
A stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before version 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors involving a long string in brackets in the ip_as_string argument.
- CVE-2015-6525High
Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta may allow attackers to cause a denial of service or possibly have other unspecified impact via 'insanely large inputs'.
- CVE-2014-6272High
Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via 'insanely large inputs'.
- CVE-2026-63385Critical
A vulnerability in Libevent before versions 2.1.13 and 2.2.2-alpha includes two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause path truncation and bypass validation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing CR or LF, allowing a proxy and libevent to interpret headers differently.
- CVE-2026-63382Critical
Libevent before versions 2.1.13 and 2.2.2-alpha inconsistently handles duplicate Transfer-Encoding headers, comma-separated values, and bare line feeds in chunked framing. This can lead to request desynchronization and request smuggling by an unauthenticated remote attacker when deployed behind a proxy.
- CVE-2016-10195Critical
The name_parse function in evdns.c in libevent before version 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, leading to an out-of-bounds stack read.
- CVE-2026-63495High
Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.
- CVE-2026-63388High
Libevent prior to 2.1.13 and 2.2.2-alpha has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
- CVE-2026-63387High
Libevent prior to 2.1.13 and 2.2.2-alpha has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Original NVD description (English source)
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.