Every CVE Search/ Get API key

CVE-2026-63387

Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

7.0 HighFix available

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

0.42%Up 0.1 points since Aug 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.0

Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
CVE-2026-63387
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-121, CWE-193, CWE-787
Updated
2026-11-02
EUVDEUVD-2026-63508 7.0

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
EUVD-2026-63508
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
NVD 7.0

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
CVE-2026-63387
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-121, CWE-193, CWE-787
Updated
2026-11-02
OSVBELL-CVE-2026-63387 7.0
Record
BELL-CVE-2026-63387
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSV 7.0

Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
CVE-2026-63387
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness
CWE-121, CWE-193, CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-63387 7.0

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
DEBIAN-CVE-2026-63387
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
Show 26 moreShow less
OSVOESA-2026-3268 8.4

libevent security update

Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor.

Security Fix(es):

The updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)

The updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)

The updated packages fix some security vulnerabilities.(CVE-2026-63382)

The updated packages fix some security vulnerabilities.(CVE-2026-63383)

The updated packages fix some security vulnerabilities.(CVE-2026-63384)

The updated packages fix some security vulnerabilities.(CVE-2026-63385)

The updated packages fix some security vulnerabilities.(CVE-2026-63387)

The updated packages fix some security vulnerabilities.(CVE-2026-63388)

Record
OESA-2026-3268
CVSS 3.1
8.4 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63388 8.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:63388
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:67908 8.6

Red Hat Security Advisory: libevent security update

Record
RHSA-2026:67908
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:67909 8.6

Red Hat Security Advisory: libevent security update

Record
RHSA-2026:67909
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:67910 8.6

Red Hat Security Advisory: libevent security update

Record
RHSA-2026:67910
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67908 8.6

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67908
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67909 8.6

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)

  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67909
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRLSA-2026:67910 8.6

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)

  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)

  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67910
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-63387 7.0

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
UBUNTU-CVE-2026-63387
CVSS 3.1
7.0 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVALSA-2026:67908 No score

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67908
Updated
2026-11-02
OSVALSA-2026:67909 No score

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67909
Updated
2026-11-02
OSVALSA-2026:67910 No score

Important: libevent security update

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

  • libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
  • libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
  • libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
  • libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
  • libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
  • libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67910
Updated
2026-11-02
OSVAZL-96918 No score

CVE-2026-63387 affecting package libtevent 0.14.1-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-96918
Updated
2026-11-02
OSVAZL-96950 No score

CVE-2026-63387 affecting package libevent for versions less than 2.1.13-1

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-96950
Updated
2026-11-02
OSVAZL-97530 No score

CVE-2026-63387 affecting package mysql for versions less than 8.0.46-2

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-97530
Updated
2026-11-05
OSVAZL-97548 No score

CVE-2026-63387 affecting package ntp for versions less than 4.2.8p17-3

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Record
AZL-97548
Updated
2026-11-05
OSVCLSA-2026-1791302296 No score

Fix CVE(s): CVE-2026-63387

  • SECURITY UPDATE: off-by-one stack overflow in dnsname_to_labels()
    • debian/patches/CVE-2026-63387.patch: fail instead of writing the terminating zero label past the end of the buffer in evdns.c
    • CVE-2026-63387
Record
CLSA-2026-1791302296
Updated
2026-11-02
OSVCLSA-2026-1792536579 No score

libevent: Fix of 5 CVEs

  • CVE-2026-63383: fix out-of-bounds read in decode_tag_internal
  • CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
  • CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
  • CVE-2026-63385: reject HTTP header values containing CR or LF
  • CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing
Record
CLSA-2026-1792536579
Updated
2026-11-02
OSVCLSA-2026-1792536927 No score

libevent: Fix of 5 CVEs

  • CVE-2026-63383: fix out-of-bounds read in decode_tag_internal
  • CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
  • CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
  • CVE-2026-63385: reject HTTP header values containing CR or LF
  • CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing
Record
CLSA-2026-1792536927
Updated
2026-11-02
OSVCLSA-2026-1792537208 No score

libevent: Fix of 5 CVEs

  • CVE-2026-63383: fix out-of-bounds read in decode_tag_internal
  • CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
  • CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
  • CVE-2026-63385: reject HTTP header values containing CR or LF
  • CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing
Record
CLSA-2026-1792537208
Updated
2026-11-02
OSVMGASA-2026-0294 No score

Updated libevent packages fix security vulnerabilities

The updated packages fix some security vulnerabilities.

Record
MGASA-2026-0294
Updated
2026-11-02
OSVopenSUSE-SU-2026:12330-1 No score

libevent-2_1-7-2.1.13-1.1 on GA media

These are all security issues fixed in the libevent-2_1-7-2.1.13-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12330-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-63387 No score

CVE-2026-63387 in libevent - Patched by Root

Root has patched CVE-2026-63387 in the libevent package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-63387
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-63387 No score

CVE-2026-63387 in libevent - Patched by Root

Root has patched CVE-2026-63387 in the libevent package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-63387
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-63387 No score

CVE-2026-63387 in libevent - Patched by Root

Root has patched CVE-2026-63387 in the libevent package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-63387
Updated
2026-11-02
OSVUSN-8840-1 No score

libevent vulnerabilities

Michał Majchrowicz and Marcin Wyczechowski discovered that libevent incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-63387)

It was discovered that libevent incorrectly handled certain connections. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63388)

Record
USN-8840-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libevent
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.1.8-11.el8_10
2.1.8-11.el8_10
libevent-devel
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.1.8-11.el8_10
2.1.8-11.el8_10
libevent-doc
AlmaLinux:8
From an advisory covering 6 CVEs
 before 2.1.8-11.el8_10
2.1.8-11.el8_10
libevent
AlmaLinux:10
From an advisory covering 8 CVEs
 before 2.1.13-1.el10_2
2.1.13-1.el10_2
libevent-devel
AlmaLinux:10
From an advisory covering 8 CVEs
 before 2.1.13-1.el10_2
2.1.13-1.el10_2
libevent-doc
AlmaLinux:10
From an advisory covering 8 CVEs
 before 2.1.13-1.el10_2
2.1.13-1.el10_2
libevent
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.1.13-1.el9_8
2.1.13-1.el9_8
libevent-devel
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.1.13-1.el9_8
2.1.13-1.el9_8
libevent-doc
AlmaLinux:9
From an advisory covering 8 CVEs
 before 2.1.13-1.el9_8
2.1.13-1.el9_8
libtevent
Azure Linux:3
 through 0.14.1-1 None known
Show 76 moreShow less
Affected packages
PackageAffectedFixed
libevent
Azure Linux:3
 before 2.1.13-1
2.1.13-1
mysql
Azure Linux:3
 before 8.0.46-2
8.0.46-2
ntp
Azure Linux:3
 before 4.2.8p17-3
4.2.8p17-3
libevent
Alpaquita:23
 2.1.12-r5 up to 2.1.13-r0
2.1.13-r0
libevent
Alpaquita:25
 2.1.12-r8 up to 2.1.13-r0
2.1.13-r0
libevent
Alpaquita:stream
 2.1.12-r4 up to 2.1.13-r0
2.1.13-r0
libevent
BellSoft Hardened Containers:23
 2.1.12-r5 up to 2.1.13-r0
2.1.13-r0
libevent
BellSoft Hardened Containers:25
 2.1.12-r8 up to 2.1.13-r0
2.1.13-r0
libevent
BellSoft Hardened Containers:stream
 2.1.12-r4 up to 2.1.13-r0
2.1.13-r0
libevent-2.1-6
TuxCare:Ubuntu:18.04
 before 2.1.8-stable-4build1+tuxcare.els2
2.1.8-stable-4build1+tuxcare.els2
libevent-core-2.1-6
TuxCare:Ubuntu:18.04
 before 2.1.8-stable-4build1+tuxcare.els2
2.1.8-stable-4build1+tuxcare.els2
libevent-dev
TuxCare:Ubuntu:18.04
 before 2.1.8-stable-4build1+tuxcare.els2
2.1.8-stable-4build1+tuxcare.els2
libevent-extra-2.1-6
TuxCare:Ubuntu:18.04
 before 2.1.8-stable-4build1+tuxcare.els2
2.1.8-stable-4build1+tuxcare.els2
libevent-openssl-2.1-6
TuxCare:Ubuntu:18.04
 before 2.1.8-stable-4build1+tuxcare.els2
2.1.8-stable-4build1+tuxcare.els2
libevent-pthreads-2.1-6
TuxCare:Ubuntu:18.04
 before 2.1.8-stable-4build1+tuxcare.els2
2.1.8-stable-4build1+tuxcare.els2
libevent
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-devel
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-doc
TuxCare:RHEL:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-devel
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-doc
TuxCare:CentOS:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-devel
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent-doc
TuxCare:OracleLinux:7
From an advisory covering 5 CVEs
 before 2.0.21-4.el7.tuxcare.els2
2.0.21-4.el7.tuxcare.els2
libevent
Debian:12
 before 2.1.12-stable-8+deb12u1, plus listed versions
2.1.12-stable-8
2.1.12-stable-8+deb12u1
libevent
Debian:13
 before 2.1.13-stable-1~deb13u1, plus listed versions
2.1.12-stable-10
2.1.13-stable-1~deb13u1
libevent
Debian:14
 before 2.1.13-stable-1, plus listed versions
2.1.12-stable-102.1.13-stable-1~deb13u1
2.1.13-stable-1
libevent
Mageia:10
From an advisory covering 8 CVEs
 before 2.1.13-1.mga10
2.1.13-1.mga10
libevent
Mageia:9
From an advisory covering 8 CVEs
 before 2.1.13-1.mga9
2.1.13-1.mga9
libevent
openEuler:24.03-LTS-SP4
From an advisory covering 8 CVEs
 before 2.1.12-17.oe2403sp4
2.1.12-17.oe2403sp4
libevent
openEuler:20.03-LTS-SP4
From an advisory covering 8 CVEs
 before 2.1.12-7.oe2003sp4
2.1.12-7.oe2003sp4
libevent
openEuler:22.03-LTS-SP4
From an advisory covering 8 CVEs
 before 2.1.12-11.oe2203sp4
2.1.12-11.oe2203sp4
libevent
openEuler:24.03-LTS-SP1
From an advisory covering 8 CVEs
 before 2.1.12-17.oe2403sp1
2.1.12-17.oe2403sp1
libevent
openEuler:24.03-LTS-SP3
From an advisory covering 8 CVEs
 before 2.1.12-17.oe2403sp3
2.1.12-17.oe2403sp3
libevent
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:2.1.13-0.1.hum1
0:2.1.13-0.1.hum1
libevent-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:2.1.13-0.1.hum1
0:2.1.13-0.1.hum1
libevent-doc
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:2.1.13-0.1.hum1
0:2.1.13-0.1.hum1
libevent-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent
Red Hat:enterprise_linux:8::baseos
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-debuginfo
Red Hat:enterprise_linux:8::baseos
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-debugsource
Red Hat:enterprise_linux:8::baseos
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-doc
Red Hat:enterprise_linux:8::baseos
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-doc
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent
Red Hat:enterprise_linux:10.2
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-doc
Red Hat:enterprise_linux:9::appstream
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent
Red Hat:enterprise_linux:9::baseos
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-debuginfo
Red Hat:enterprise_linux:9::baseos
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent-debugsource
Red Hat:enterprise_linux:9::baseos
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent
Rocky Linux:8
From an advisory covering 6 CVEs
 before 0:2.1.8-11.el8_10
0:2.1.8-11.el8_10
libevent
Rocky Linux:10
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el10_2
0:2.1.13-1.el10_2
libevent
Rocky Linux:9
From an advisory covering 8 CVEs
 before 0:2.1.13-1.el9_8
0:2.1.13-1.el9_8
libevent
Root:Debian:11
 before 2.1.12-stable-1.aikido.2
2.1.12-stable-1.aikido.22.1.12-stable-1.aikido.3
rootio-libevent
Root:Debian:11
 before 2.1.12-stable-1.aikido.2
2.1.12-stable-1.aikido.22.1.12-stable-1.aikido.3
libevent
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2.0.21-stable-12.0.21-stable-1ubuntu12.0.21-stable-1ubuntu1.14.04.12.0.21-stable-1ubuntu1.14.04.22.0.21-stable-1ubuntu1.14.04.2+esm12.0.21-stable-1ubuntu1.14.04.2+esm2
 None known
libevent
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.0.21-stable-22.0.21-stable-2ubuntu0.16.04.12.0.21-stable-2ubuntu0.16.04.1+esm12.0.21-stable-2ubuntu0.16.04.1+esm2
 None known
libevent
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.1.8-stable-42.1.8-stable-4build12.1.8-stable-4ubuntu0.1~esm12.1.8-stable-4ubuntu0.1~esm2
 None known
libevent
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.1.8-stable-4build12.1.11-stable-1~exp02.1.11-stable-12.1.11-stable-1ubuntu0.1~esm12.1.11-stable-1ubuntu0.1~esm2
 None known
libevent
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.1.12-stable-12.1.12-stable-1build12.1.12-stable-1build22.1.12-stable-1build32.1.12-stable-1ubuntu0.12.1.12-stable-1ubuntu0.2
 None known
libevent
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.1.12-stable-92.1.12-stable-9ubuntu22.1.12-stable-9ubuntu2.12.1.12-stable-9ubuntu2.2
 None known
libevent
Ubuntu:26.04:LTS
 before 2.1.12-stable-10ubuntu0.2, plus listed versions
2.1.12-stable-10build12.1.12-stable-10build22.1.12-stable-10ubuntu0.1
2.1.12-stable-10ubuntu0.2
libevent
Ubuntu:Pro:14.04:LTS
From an advisory covering 2 CVEs
 before 2.0.21-stable-1ubuntu1.14.04.2+esm2, plus listed versions
2.0.21-stable-12.0.21-stable-1ubuntu12.0.21-stable-1ubuntu1.14.04.12.0.21-stable-1ubuntu1.14.04.22.0.21-stable-1ubuntu1.14.04.2+esm1
2.0.21-stable-1ubuntu1.14.04.2+esm2
libevent
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 2.0.21-stable-2ubuntu0.16.04.1+esm2, plus listed versions
2.0.21-stable-22.0.21-stable-2ubuntu0.16.04.12.0.21-stable-2ubuntu0.16.04.1+esm1
2.0.21-stable-2ubuntu0.16.04.1+esm2
libevent
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 2.1.8-stable-4ubuntu0.1~esm2, plus listed versions
2.1.8-stable-42.1.8-stable-4build12.1.8-stable-4ubuntu0.1~esm1
2.1.8-stable-4ubuntu0.1~esm2
libevent
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 2.1.11-stable-1ubuntu0.1~esm2, plus listed versions
2.1.8-stable-4build12.1.11-stable-1~exp02.1.11-stable-12.1.11-stable-1ubuntu0.1~esm1
2.1.11-stable-1ubuntu0.1~esm2
libevent
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 2.1.12-stable-1ubuntu0.2, plus listed versions
2.1.12-stable-12.1.12-stable-1build12.1.12-stable-1build22.1.12-stable-1build32.1.12-stable-1ubuntu0.1
2.1.12-stable-1ubuntu0.2
libevent
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 2.1.12-stable-9ubuntu2.2, plus listed versions
2.1.12-stable-92.1.12-stable-9ubuntu22.1.12-stable-9ubuntu2.1
2.1.12-stable-9ubuntu2.2
libevent
Ubuntu:26.04:LTS
From an advisory covering 2 CVEs
 before 2.1.12-stable-10ubuntu0.2, plus listed versions
2.1.12-stable-10build12.1.12-stable-10build22.1.12-stable-10ubuntu0.1
2.1.12-stable-10ubuntu0.2
libevent
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 2.1.13-1.1
2.1.13-1.1

History

History
RecordedChangedSources
affected
factsOSV
affected
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-63387 is a high vulnerability (CVSS 7.0) in Libevent, published July 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in libevent 2.1.13-1.

References

Show 97 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open