CVE-2026-63385

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

• libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

• libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

• libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

• libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

• libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

• libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

• libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

• libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

• libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)

• libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

• libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

• libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

• libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

• libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

• libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

• libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

• libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)

• libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

• libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

• libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

• libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

• libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

• libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
• libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
• libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
• libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
• libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
• libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

• libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
• libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
• libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
• libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
• libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
• libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
• libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
• libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

• libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
• libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
• libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
• libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
• libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
• libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
• libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
• libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.

• Fix CVE-2026-63381 - use-after-free in evbuffer_add_buffer_reference()
• Fix CVE-2026-63385 - HTTP header injection via CR/LF in header values
• Fix CVE-2026-63382 - HTTP request smuggling via Transfer-Encoding handling and bare-LF chunk framing
• Fix CVE-2026-63379 - HTTP header smuggling via chunked trailers

• CVE-2026-63383: fix out-of-bounds read in decode_tag_internal
• CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
• CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
• CVE-2026-63385: reject HTTP header values containing CR or LF
• CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing

• CVE-2026-63383: fix out-of-bounds read in decode_tag_internal
• CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
• CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
• CVE-2026-63385: reject HTTP header values containing CR or LF
• CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing

• CVE-2026-63383: fix out-of-bounds read in decode_tag_internal
• CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
• CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
• CVE-2026-63385: reject HTTP header values containing CR or LF
• CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing

The updated packages fix some security vulnerabilities.

These are all security issues fixed in the libevent-2_1-7-2.1.13-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2026-63385 in the libevent package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-63385 in the libevent package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-63385 in the libevent package for Root:Debian:13. Multiple fixed versions available.

Alexis Challande discovered that libevent incorrectly handled certain empty output buffers. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63381)

Rajat Raghav discovered that libevent incorrectly handled certain HTTP requests. An attacker could possibly use this issue to desynchronize HTTP request boundaries, resulting in HTTP request smuggling. (CVE-2026-63382)

Qiu Sihao discovered that libevent incorrectly handled certain malformed tagged RPC data. An attacker could possibly use this issue to trigger an out-of-bounds read, resulting in a denial of service. (CVE-2026-63383)

Qiu Sihao discovered that libevent incorrectly handled certain large payload lengths in tagged RPC data. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. (CVE-2026-63384)

Asaf Meizner discovered that libevent incorrectly handled certain HTTP URIs and header values. An attacker could possibly use this issue to cause HTTP messages to be interpreted inconsistently, resulting in security restrictions being bypassed. (CVE-2026-63385)