Every CVE Search/ Get API key

CVE-2026-63384

Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

8.7 HighFix available

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.49%Up 0.1 points since Aug 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
CVE-2026-63384
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-190
Updated
2026-11-02
EUVDEUVD-2026-63507 8.7

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
EUVD-2026-63507
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
NVD 8.7

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
CVE-2026-63384
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-190
Updated
2026-11-02
OSV 8.7

Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
CVE-2026-63384
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-190
Updated
2026-11-02
OSVDEBIAN-CVE-2026-63384 8.7

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
DEBIAN-CVE-2026-63384
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-3268 8.4

libevent security update

Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor.

Security Fix(es):

The updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)

The updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)

The updated packages fix some security vulnerabilities.(CVE-2026-63382)

The updated packages fix some security vulnerabilities.(CVE-2026-63383)

The updated packages fix some security vulnerabilities.(CVE-2026-63384)

The updated packages fix some security vulnerabilities.(CVE-2026-63385)

The updated packages fix some security vulnerabilities.(CVE-2026-63387)

The updated packages fix some security vulnerabilities.(CVE-2026-63388)

Record
OESA-2026-3268
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 25 moreShow less
OSVRHSA-2026:60853 8.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:60853
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:67908 8.6

Red Hat Security Advisory: libevent security update

Record
RHSA-2026:67908
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:67909 8.6

Red Hat Security Advisory: libevent security update

Record
RHSA-2026:67909
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:67910 8.6

Red Hat Security Advisory: libevent security update

Record
RHSA-2026:67910
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67908 8.6

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67908
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67909 8.6

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)

  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67909
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67910 8.6

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)

  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67910
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-63384 8.7

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
UBUNTU-CVE-2026-63384
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVALSA-2026:67908 No score

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67908
Updated
2026-11-02
OSVALSA-2026:67909 No score

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67909
Updated
2026-11-02
OSVALSA-2026:67910 No score

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67910
Updated
2026-11-02
OSVAZL-96906 No score

CVE-2026-63384 affecting package libtevent 0.14.1-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-96906
Updated
2026-11-02
OSVAZL-96935 No score

CVE-2026-63384 affecting package libevent for versions less than 2.1.13-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-96935
Updated
2026-11-02
OSVAZL-97524 No score

CVE-2026-63384 affecting package mysql for versions less than 8.0.46-2

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-97524
Updated
2026-11-05
OSVAZL-97554 No score

CVE-2026-63384 affecting package ntp for versions less than 4.2.8p17-3

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-97554
Updated
2026-11-05
OSVCLSA-2026-1790251955 No score

Fix CVE(s): CVE-2026-63383, CVE-2026-63384

  • SECURITY UPDATE: integer overflow in evtag_unmarshal_header()
    • debian/patches/CVE-2026-63384.patch: reject payload lengths above INT_MAX in event_tagging.c, include/event2/tag.h
    • CVE-2026-63384
  • SECURITY UPDATE: out-of-bounds read in decode_tag_internal()
    • debian/patches/CVE-2026-63383.patch: bound the tag decoding loop by the pulled-up length instead of the full buffer length in event_tagging.c
    • CVE-2026-63383
Record
CLSA-2026-1790251955
Updated
2026-11-02
OSVCLSA-2026-1792536579 No score

libevent: Fix of 5 CVEs

  • CVE-2026-63383: fix out-of-bounds read in decode_tag_internal
  • CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
  • CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
  • CVE-2026-63385: reject HTTP header values containing CR or LF
  • CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing
Record
CLSA-2026-1792536579
Updated
2026-11-02
OSVCLSA-2026-1792536927 No score

libevent: Fix of 5 CVEs

  • CVE-2026-63383: fix out-of-bounds read in decode_tag_internal
  • CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
  • CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
  • CVE-2026-63385: reject HTTP header values containing CR or LF
  • CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing
Record
CLSA-2026-1792536927
Updated
2026-11-02
OSVCLSA-2026-1792537208 No score

libevent: Fix of 5 CVEs

  • CVE-2026-63383: fix out-of-bounds read in decode_tag_internal
  • CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
  • CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
  • CVE-2026-63385: reject HTTP header values containing CR or LF
  • CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing
Record
CLSA-2026-1792537208
Updated
2026-11-02
OSVMGASA-2026-0294 No score

Updated libevent packages fix security vulnerabilities

The updated packages fix some security vulnerabilities.

Record
MGASA-2026-0294
Updated
2026-11-02
OSVopenSUSE-SU-2026:12330-1 No score

libevent-2_1-7-2.1.13-1.1 on GA media

These are all security issues fixed in the libevent-2_1-7-2.1.13-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12330-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-63384 No score

CVE-2026-63384 in libevent - Patched by Root

Root has patched CVE-2026-63384 in the libevent package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-63384
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-63384 No score

CVE-2026-63384 in libevent - Patched by Root

Root has patched CVE-2026-63384 in the libevent package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-63384
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-63384 No score

CVE-2026-63384 in libevent - Patched by Root

Root has patched CVE-2026-63384 in the libevent package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-63384
Updated
2026-11-02
OSVUSN-8710-1 No score

libevent vulnerabilities

Alexis Challande discovered that libevent incorrectly handled certain empty output buffers. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63381)

Rajat Raghav discovered that libevent incorrectly handled certain HTTP requests. An attacker could possibly use this issue to desynchronize HTTP request boundaries, resulting in HTTP request smuggling. (CVE-2026-63382)

Qiu Sihao discovered that libevent incorrectly handled certain malformed tagged RPC data. An attacker could possibly use this issue to trigger an out-of-bounds read, resulting in a denial of service. (CVE-2026-63383)

Qiu Sihao discovered that libevent incorrectly handled certain large payload lengths in tagged RPC data. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. (CVE-2026-63384)

Asaf Meizner discovered that libevent incorrectly handled certain HTTP URIs and header values. An attacker could possibly use this issue to cause HTTP messages to be interpreted inconsistently, resulting in security restrictions being bypassed. (CVE-2026-63385)

Record
USN-8710-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libevent
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.1.8-11.el8_10
2.1.8-11.el8_10
libevent-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.1.8-11.el8_10
2.1.8-11.el8_10
libevent-doc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.1.8-11.el8_10
2.1.8-11.el8_10
libevent
AlmaLinux:10
From an advisory covering 8 CVEs
 before 2.1.13-1.el10_2
2.1.13-1.el10_2
libevent-devel
AlmaLinux:10
From an advisory covering 8 CVEs
 before 2.1.13-1.el10_2
2.1.13-1.el10_2
libevent-doc
AlmaLinux:10
From an advisory covering 8 CVEs
 before 2.1.13-1.el10_2
2.1.13-1.el10_2
libevent
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.1.13-1.el9_8
2.1.13-1.el9_8
libevent-devel
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.1.13-1.el9_8
2.1.13-1.el9_8
libevent-doc
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.1.13-1.el9_8
2.1.13-1.el9_8
libtevent
Azure Linux:3
 through 0.14.1-1 None known
Show 76 moreShow less
Affected packages
PackageAffectedFixed
libevent
Azure Linux:3
 before 2.1.13-1
2.1.13-1
mysql
Azure Linux:3
 before 8.0.46-2
8.0.46-2
ntp
Azure Linux:3
 before 4.2.8p17-3
4.2.8p17-3
libevent
Alpaquita:23
 2.1.12-r5 up to 2.1.13-r0
2.1.13-r0
libevent
Alpaquita:25
 2.1.12-r8 up to 2.1.13-r0
2.1.13-r0
libevent
Alpaquita:stream
 2.1.12-r4 up to 2.1.13-r0
2.1.13-r0
libevent
BellSoft Hardened Containers:23
 2.1.12-r5 up to 2.1.13-r0
2.1.13-r0
libevent
BellSoft Hardened Containers:25
 2.1.12-r8 up to 2.1.13-r0
2.1.13-r0
libevent
BellSoft Hardened Containers:stream
 2.1.12-r4 up to 2.1.13-r0
2.1.13-r0
libevent-2.1-6
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 2.1.8-stable-4build1+tuxcare.els1
2.1.8-stable-4build1+tuxcare.els1
libevent-core-2.1-6
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 2.1.8-stable-4build1+tuxcare.els1
2.1.8-stable-4build1+tuxcare.els1
libevent-dev
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 2.1.8-stable-4build1+tuxcare.els1
2.1.8-stable-4build1+tuxcare.els1
libevent-extra-2.1-6
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 2.1.8-stable-4build1+tuxcare.els1
2.1.8-stable-4build1+tuxcare.els1
libevent-openssl-2.1-6
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 2.1.8-stable-4build1+tuxcare.els1
2.1.8-stable-4build1+tuxcare.els1
libevent-pthreads-2.1-6
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 2.1.8-stable-4build1+tuxcare.els1
2.1.8-stable-4build1+tuxcare.els1
libevent
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-devel
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-doc
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-devel
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-doc
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-devel
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-doc
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent
Debian:12
 before 2.1.12-stable-8+deb12u1, plus listed versions
2.1.12-stable-8
2.1.12-stable-8+deb12u1
libevent
Debian:13
 before 2.1.13-stable-1~deb13u1, plus listed versions
2.1.12-stable-10
2.1.13-stable-1~deb13u1
libevent
Debian:14
 before 2.1.13-stable-1, plus listed versions
2.1.12-stable-102.1.13-stable-1~deb13u1
2.1.13-stable-1
libevent
Mageia:10
From an advisory covering 8 CVEs
 before 2.1.13-1.mga10
2.1.13-1.mga10
libevent
Mageia:9
From an advisory covering 8 CVEs
 before 2.1.13-1.mga9
2.1.13-1.mga9
libevent
openEuler:24.03-LTS-SP4
From an advisory covering 8 CVEs
 before 2.1.12-17.oe2403sp4
2.1.12-17.oe2403sp4
libevent
openEuler:20.03-LTS-SP4
From an advisory covering 8 CVEs
 before 2.1.12-7.oe2003sp4
2.1.12-7.oe2003sp4
libevent
openEuler:22.03-LTS-SP4
From an advisory covering 8 CVEs
 before 2.1.12-11.oe2203sp4
2.1.12-11.oe2203sp4
libevent
openEuler:24.03-LTS-SP1
From an advisory covering 8 CVEs
 before 2.1.12-17.oe2403sp1
2.1.12-17.oe2403sp1
libevent
openEuler:24.03-LTS-SP3
From an advisory covering 8 CVEs
 before 2.1.12-17.oe2403sp3
2.1.12-17.oe2403sp3
libevent
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:2.1.12-19.1.hum1
0:2.1.12-19.1.hum1
libevent-devel
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:2.1.12-19.1.hum1
0:2.1.12-19.1.hum1
libevent-doc
Red Hat:hummingbird:1
From an advisory covering 5 CVEs
 before 0:2.1.12-19.1.hum1
0:2.1.12-19.1.hum1
libevent-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent
Red Hat:enterprise_linux:8::baseos
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-doc
Red Hat:enterprise_linux:8::baseos
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-doc
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-doc
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent
Red Hat:enterprise_linux:9::baseos
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent
Rocky Linux:10
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent
Root:Debian:11
 before 2.1.12-stable-1.aikido.2
2.1.12-stable-1.aikido.22.1.12-stable-1.aikido.3
rootio-libevent
Root:Debian:11
 before 2.1.12-stable-1.aikido.2
2.1.12-stable-1.aikido.22.1.12-stable-1.aikido.3
libevent
Ubuntu:Pro:14.04:LTS
 before 2.0.21-stable-1ubuntu1.14.04.2+esm1, plus listed versions
2.0.21-stable-12.0.21-stable-1ubuntu12.0.21-stable-1ubuntu1.14.04.12.0.21-stable-1ubuntu1.14.04.2
2.0.21-stable-1ubuntu1.14.04.2+esm1
libevent
Ubuntu:Pro:16.04:LTS
 before 2.0.21-stable-2ubuntu0.16.04.1+esm1, plus listed versions
2.0.21-stable-22.0.21-stable-2ubuntu0.16.04.1
2.0.21-stable-2ubuntu0.16.04.1+esm1
libevent
Ubuntu:Pro:18.04:LTS
 before 2.1.8-stable-4ubuntu0.1~esm1, plus listed versions
2.1.8-stable-42.1.8-stable-4build1
2.1.8-stable-4ubuntu0.1~esm1
libevent
Ubuntu:Pro:20.04:LTS
 before 2.1.11-stable-1ubuntu0.1~esm1, plus listed versions
2.1.8-stable-4build12.1.11-stable-1~exp02.1.11-stable-1
2.1.11-stable-1ubuntu0.1~esm1
libevent
Ubuntu:22.04:LTS
 before 2.1.12-stable-1ubuntu0.1, plus listed versions
2.1.12-stable-12.1.12-stable-1build12.1.12-stable-1build22.1.12-stable-1build3
2.1.12-stable-1ubuntu0.1
libevent
Ubuntu:24.04:LTS
 before 2.1.12-stable-9ubuntu2.1, plus listed versions
2.1.12-stable-92.1.12-stable-9ubuntu2
2.1.12-stable-9ubuntu2.1
libevent
Ubuntu:26.04:LTS
 before 2.1.12-stable-10ubuntu0.1, plus listed versions
2.1.12-stable-10build12.1.12-stable-10build2
2.1.12-stable-10ubuntu0.1
libevent
Ubuntu:Pro:14.04:LTS
From an advisory covering 5 CVEs
 before 2.0.21-stable-1ubuntu1.14.04.2+esm1, plus listed versions
2.0.21-stable-12.0.21-stable-1ubuntu12.0.21-stable-1ubuntu1.14.04.12.0.21-stable-1ubuntu1.14.04.2
2.0.21-stable-1ubuntu1.14.04.2+esm1
libevent
Ubuntu:Pro:16.04:LTS
From an advisory covering 5 CVEs
 before 2.0.21-stable-2ubuntu0.16.04.1+esm1, plus listed versions
2.0.21-stable-22.0.21-stable-2ubuntu0.16.04.1
2.0.21-stable-2ubuntu0.16.04.1+esm1
libevent
Ubuntu:Pro:18.04:LTS
From an advisory covering 5 CVEs
 before 2.1.8-stable-4ubuntu0.1~esm1, plus listed versions
2.1.8-stable-42.1.8-stable-4build1
2.1.8-stable-4ubuntu0.1~esm1
libevent
Ubuntu:Pro:20.04:LTS
From an advisory covering 5 CVEs
 before 2.1.11-stable-1ubuntu0.1~esm1, plus listed versions
2.1.8-stable-4build12.1.11-stable-1~exp02.1.11-stable-1
2.1.11-stable-1ubuntu0.1~esm1
libevent
Ubuntu:22.04:LTS
From an advisory covering 5 CVEs
 before 2.1.12-stable-1ubuntu0.1, plus listed versions
2.1.12-stable-12.1.12-stable-1build12.1.12-stable-1build22.1.12-stable-1build3
2.1.12-stable-1ubuntu0.1
libevent
Ubuntu:24.04:LTS
From an advisory covering 5 CVEs
 before 2.1.12-stable-9ubuntu2.1, plus listed versions
2.1.12-stable-92.1.12-stable-9ubuntu2
2.1.12-stable-9ubuntu2.1
libevent
Ubuntu:26.04:LTS
From an advisory covering 5 CVEs
 before 2.1.12-stable-10ubuntu0.1, plus listed versions
2.1.12-stable-10build12.1.12-stable-10build2
2.1.12-stable-10ubuntu0.1
libevent
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 2.1.13-1.1
2.1.13-1.1

History

History
RecordedChangedSources
affected
factsOSV
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-63384 is a high vulnerability (CVSS 8.7) in Libevent, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in libevent 2.1.13-1.

References

Show 100 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open