636 matches found
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106194)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106194 advisory. Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when...
libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption
A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the dnsnametolabels function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libevent: libevent-2.1.13-0.1.hum1 aarch64, x8664 libevent-devel-2.1.13-0.1.hum1 aarch64, x8664 libevent-doc-2.1.13-0.1.hum1 noarch libevent-2.1.13-0.1.hum1.src src Security Fixes: libevent:...
libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling
A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...
libevent: Libevent: HTTP header handling bugs create risk of access control bypass.
A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...
CVE-2026-63385
A flaw was found in libevent. The evhttpdecodeuriinternal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes...
CVE-2026-63382
A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successf...
CVE-2026-63384 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63384 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63388 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63388 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63383 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63383 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63387 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63387 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63382 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63382 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63379 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63379 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1
CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...
USN-8710-1 libevent vulnerabilities
Alexis Challande discovered that libevent incorrectly handled certain empty output buffers. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.0...
USN-8710-1: libevent vulnerabilities
Alexis Challande discovered that libevent incorrectly handled certain empty output buffers. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.0...
TencentOS Server 4: libevent (TSSA-2026:0884)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0884 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...
