ROOT-OS-DEBIAN-13-CVE-2026-63387 CVE-2026-63387 in libevent - Patched by Root

Root has patched CVE-2026-63387 in the libevent package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-63384 CVE-2026-63384 in libevent - Patched by Root

Root has patched CVE-2026-63384 in the libevent package for Root:Debian:13. Multiple fixed versions available...

libevent: Libevent: Denial of Service via malformed RPC data

A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the decodetaginternal function by sending specially crafted, attacker-controlled tagged RPC Remote Procedure Call data. This could lead to a denial of service, causi...

libevent: Libevent: Memory corruption due to use-after-free

A flaw was found in Libevent, an event notification library. A use-after-free vulnerability exists in the evbufferaddbufferreference function when it processes an output buffer with a zero length. This can lead to a dangling pointer, which an attacker could exploit to cause memory corruption or...

libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning

A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP Hypertext Transfer Protocol trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libevent: libevent-2.1.12-19.1.hum1 aarch64, x8664 libevent-devel-2.1.12-19.1.hum1 aarch64, x8664 libevent-doc-2.1.12-19.1.hum1 noarch libevent-2.1.12-19.1.hum1.src src Security Fixes: libevent:...

libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header`

A flaw was found in Libevent. An incorrect integer conversion in the evtagunmarshalheader function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service DoS for the affected system...

libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the buffereventsocketsetconnaddress function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AFUNIX listener, an attacker can overwrite critical heap data, leading to memory...

CVE-2026-63381

A flaw was found in Libevent, an event notification library. A use-after-free vulnerability exists in the evbufferaddbufferreference function when it processes an output buffer with a zero length. This can lead to a dangling pointer, which an attacker could exploit to cause memory corruption or...

CVE-2026-63379

A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP Hypertext Transfer Protocol trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers,...

CVE-2026-63388

A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the buffereventsocketsetconnaddress function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AFUNIX listener, an attacker can overwrite critical heap data, leading to memory...

CVE-2026-63380

A flaw was found in Libevent, an event notification library. This vulnerability allows a local attacker to trigger a null pointer dereference during specific error handling within the evwsnewsession function. By inducing an allocation or locking failure, an attacker can cause the application to...

CVE-2026-63387

A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the dnsnametolabels function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the...

CVE-2026-63495

A flaw was found in Libevent. An unauthenticated remote client can exploit this vulnerability by repeatedly sending fragmented WebSocket frames to the Libevent WebSocket server. Due to a lack of a total message-size limit, these fragmented frames accumulate in memory without bound, leading to...

CVE-2026-63384

A flaw was found in Libevent. An incorrect integer conversion in the evtagunmarshalheader function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service DoS for the affected system. Mitigation...

CVE-2026-63383

A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the decodetaginternal function by sending specially crafted, attacker-controlled tagged RPC Remote Procedure Call data. This could lead to a denial of service, causi...

The vulnerability of the evws_new_session() function in the Libevent asynchronous event notification library allows a hacker to trigger a service failure.

The vulnerability of the evwsnewsession function in the Libevent asynchronous event notification library is related to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a attacker to cause a service failure...

The vulnerability of the evhttp_find_header() function in the evhttp HTTP parser library from the asynchronous event notification library Libevent allows a attacker to cause a service failure.

The vulnerability of the evhttpfindheader function in the evhttp HTTP parser from the Libevent asynchronous event handling library is related to deficiencies in HTTP request processing. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the evtag_unmarshal_header() function in the Libevent asynchronous event notification library allows a attacker to cause a service failure.

The vulnerability of the evtagunmarshalheader function in the Libevent asynchronous event notification library is related to integer overflow. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the ws.c file of the WebSocket server in the Libevent library allows a attacker to induce a service failure.

The vulnerability of the ws.c file of the WebSocket server in the Libevent library-related event notification asynchronous library is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...