Every CVE Search/ Get API key

CVE-2026-63379

Libevent: HTTP Header smuggling

6.3 MediumFix available

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.52%Unchanged since Aug 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

Libevent: HTTP Header smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
CVE-2026-63379
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2026-63562 6.3

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
EUVD-2026-63562
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 6.3

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
CVE-2026-63379
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-444
Updated
2026-11-02
OSV 6.3

Libevent: HTTP Header smuggling

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
CVE-2026-63379
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-444
Updated
2026-11-02
OSVDEBIAN-CVE-2026-63379 6.3

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
DEBIAN-CVE-2026-63379
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-3268 8.4

libevent security update

Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor.

Security Fix(es):

The updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)

The updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)

The updated packages fix some security vulnerabilities.(CVE-2026-63382)

The updated packages fix some security vulnerabilities.(CVE-2026-63383)

The updated packages fix some security vulnerabilities.(CVE-2026-63384)

The updated packages fix some security vulnerabilities.(CVE-2026-63385)

The updated packages fix some security vulnerabilities.(CVE-2026-63387)

The updated packages fix some security vulnerabilities.(CVE-2026-63388)

Record
OESA-2026-3268
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 15 moreShow less
OSVRHSA-2026:60853 8.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:60853
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:67909 8.6

Red Hat Security Advisory: libevent security update

Record
RHSA-2026:67909
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:67910 8.6

Red Hat Security Advisory: libevent security update

Record
RHSA-2026:67910
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67909 8.6

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)

  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67909
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67910 8.6

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)

  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67910
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-63379 6.3

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
UBUNTU-CVE-2026-63379
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVALSA-2026:67909 No score

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67909
Updated
2026-11-02
OSVALSA-2026:67910 No score

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67910
Updated
2026-11-02
OSVAZL-96903 No score

CVE-2026-63379 affecting package libtevent 0.14.1-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-96903
Updated
2026-11-02
OSVAZL-96941 No score

CVE-2026-63379 affecting package libevent for versions less than 2.1.13-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-96941
Updated
2026-11-02
OSVAZL-97533 No score

CVE-2026-63379 affecting package mysql for versions less than 8.0.46-2

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-97533
Updated
2026-11-05
OSVAZL-97557 No score

CVE-2026-63379 affecting package ntp for versions less than 4.2.8p17-3

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-97557
Updated
2026-11-05
OSVCLSA-2026-1790587734 No score

libevent: Fix of 8 CVEs

  • Fix CVE-2026-63381 - use-after-free in evbuffer_add_buffer_reference()
  • Fix CVE-2026-63385 - HTTP header injection via CR/LF in header values
  • Fix CVE-2026-63382 - HTTP request smuggling via Transfer-Encoding handling and bare-LF chunk framing
  • Fix CVE-2026-63379 - HTTP header smuggling via chunked trailers
Record
CLSA-2026-1790587734
Updated
2026-11-02
OSVMGASA-2026-0294 No score

Updated libevent packages fix security vulnerabilities

The updated packages fix some security vulnerabilities.

Record
MGASA-2026-0294
Updated
2026-11-02
OSVopenSUSE-SU-2026:12330-1 No score

libevent-2_1-7-2.1.13-1.1 on GA media

These are all security issues fixed in the libevent-2_1-7-2.1.13-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12330-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libevent
AlmaLinux:10
From an advisory covering 8 CVEs
 before 2.1.13-1.el10_2
2.1.13-1.el10_2
libevent-devel
AlmaLinux:10
From an advisory covering 8 CVEs
 before 2.1.13-1.el10_2
2.1.13-1.el10_2
libevent-doc
AlmaLinux:10
From an advisory covering 8 CVEs
 before 2.1.13-1.el10_2
2.1.13-1.el10_2
libevent
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.1.13-1.el9_8
2.1.13-1.el9_8
libevent-devel
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.1.13-1.el9_8
2.1.13-1.el9_8
libevent-doc
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.1.13-1.el9_8
2.1.13-1.el9_8
libtevent
Azure Linux:3
 through 0.14.1-1 None known
libevent
Azure Linux:3
 before 2.1.13-1
2.1.13-1
mysql
Azure Linux:3
 before 8.0.46-2
8.0.46-2
ntp
Azure Linux:3
 before 4.2.8p17-3
4.2.8p17-3
Show 45 moreShow less
Affected packages
PackageAffectedFixed
libevent
Alpaquita:23
 2.1.12-r5 up to 2.1.13-r0
2.1.13-r0
libevent
Alpaquita:25
 2.1.12-r8 up to 2.1.13-r0
2.1.13-r0
libevent
Alpaquita:stream
 2.1.12-r4 up to 2.1.13-r0
2.1.13-r0
libevent
BellSoft Hardened Containers:23
 2.1.12-r5 up to 2.1.13-r0
2.1.13-r0
libevent
BellSoft Hardened Containers:25
 2.1.12-r8 up to 2.1.13-r0
2.1.13-r0
libevent
BellSoft Hardened Containers:stream
 2.1.12-r4 up to 2.1.13-r0
2.1.13-r0
libevent
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.1.12-8.el9_6.tuxcare.els2
2.1.12-8.el9_6.tuxcare.els2
libevent-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.1.12-8.el9_6.tuxcare.els2
2.1.12-8.el9_6.tuxcare.els2
libevent-doc
TuxCare:AlmaLinux:9.6
From an advisory covering 4 CVEs
 before 2.1.12-8.el9_6.tuxcare.els2
2.1.12-8.el9_6.tuxcare.els2
libevent
Debian:12
 before 2.1.12-stable-8+deb12u1, plus listed versions
2.1.12-stable-8
2.1.12-stable-8+deb12u1
libevent
Debian:13
 before 2.1.13-stable-1~deb13u1, plus listed versions
2.1.12-stable-10
2.1.13-stable-1~deb13u1
libevent
Debian:14
 before 2.1.13-stable-1, plus listed versions
2.1.12-stable-102.1.13-stable-1~deb13u1
2.1.13-stable-1
libevent
Mageia:10
From an advisory covering 8 CVEs
 before 2.1.13-1.mga10
2.1.13-1.mga10
libevent
Mageia:9
From an advisory covering 8 CVEs
 before 2.1.13-1.mga9
2.1.13-1.mga9
libevent
openEuler:24.03-LTS-SP4
From an advisory covering 8 CVEs
 before 2.1.12-17.oe2403sp4
2.1.12-17.oe2403sp4
libevent
openEuler:20.03-LTS-SP4
From an advisory covering 8 CVEs
 before 2.1.12-7.oe2003sp4
2.1.12-7.oe2003sp4
libevent
openEuler:22.03-LTS-SP4
From an advisory covering 8 CVEs
 before 2.1.12-11.oe2203sp4
2.1.12-11.oe2203sp4
libevent
openEuler:24.03-LTS-SP1
From an advisory covering 8 CVEs
 before 2.1.12-17.oe2403sp1
2.1.12-17.oe2403sp1
libevent
openEuler:24.03-LTS-SP3
From an advisory covering 8 CVEs
 before 2.1.12-17.oe2403sp3
2.1.12-17.oe2403sp3
libevent
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:2.1.12-19.1.hum1
0:2.1.12-19.1.hum1
libevent-devel
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:2.1.12-19.1.hum1
0:2.1.12-19.1.hum1
libevent-doc
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:2.1.12-19.1.hum1
0:2.1.12-19.1.hum1
libevent-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-doc
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-doc
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent
Red Hat:enterprise_linux:9::baseos
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent
Rocky Linux:10
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.0.21-stable-12.0.21-stable-1ubuntu12.0.21-stable-1ubuntu1.14.04.12.0.21-stable-1ubuntu1.14.04.22.0.21-stable-1ubuntu1.14.04.2+esm12.0.21-stable-1ubuntu1.14.04.2+esm2
 None known
libevent
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.0.21-stable-22.0.21-stable-2ubuntu0.16.04.12.0.21-stable-2ubuntu0.16.04.1+esm12.0.21-stable-2ubuntu0.16.04.1+esm2
 None known
libevent
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.1.8-stable-42.1.8-stable-4build12.1.8-stable-4ubuntu0.1~esm12.1.8-stable-4ubuntu0.1~esm2
 None known
libevent
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.1.8-stable-4build12.1.11-stable-1~exp02.1.11-stable-12.1.11-stable-1ubuntu0.1~esm12.1.11-stable-1ubuntu0.1~esm2
 None known
libevent
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.1.12-stable-12.1.12-stable-1build12.1.12-stable-1build22.1.12-stable-1build32.1.12-stable-1ubuntu0.12.1.12-stable-1ubuntu0.2
 None known
libevent
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.1.12-stable-92.1.12-stable-9ubuntu22.1.12-stable-9ubuntu2.12.1.12-stable-9ubuntu2.2
 None known
libevent
Ubuntu:26.10
 All versions, plus listed versions
2.1.12-stable-10build22.1.13-stable-1build1
 None known
libevent
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.1.12-stable-10build12.1.12-stable-10build22.1.12-stable-10ubuntu0.12.1.12-stable-10ubuntu0.2
 None known
libevent
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 2.1.13-1.1
2.1.13-1.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-63379 is a medium vulnerability (CVSS 6.3) in Libevent, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in libevent 2.1.13-1.

References

Show 88 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open