{"id":"CVE-2026-63380","aliases":["AZL-96912","EUVD-2026-63506","GHSA-3rpf-frgx-xq34","UBUNTU-CVE-2026-63380"],"status":"published","title":"Libevent: Null Pointer Dereference in `evws_new_session`","description":"Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server-\u003ews_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.","severity":{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0014,"percentile":0.03441,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-416","CWE-476"],"published":"2026-08-20T17:52:29Z","modified":"2026-10-28T11:17:04Z","affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libtevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.14.1-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.21-stable-1","2.0.21-stable-1ubuntu1","2.0.21-stable-1ubuntu1.14.04.1","2.0.21-stable-1ubuntu1.14.04.2","2.0.21-stable-1ubuntu1.14.04.2+esm1","2.0.21-stable-1ubuntu1.14.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.21-stable-2","2.0.21-stable-2ubuntu0.16.04.1","2.0.21-stable-2ubuntu0.16.04.1+esm1","2.0.21-stable-2ubuntu0.16.04.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.8-stable-4","2.1.8-stable-4build1","2.1.8-stable-4ubuntu0.1~esm1","2.1.8-stable-4ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.8-stable-4build1","2.1.11-stable-1~exp0","2.1.11-stable-1","2.1.11-stable-1ubuntu0.1~esm1","2.1.11-stable-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.12-stable-1","2.1.12-stable-1build1","2.1.12-stable-1build2","2.1.12-stable-1build3","2.1.12-stable-1ubuntu0.1","2.1.12-stable-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.12-stable-9","2.1.12-stable-9ubuntu2","2.1.12-stable-9ubuntu2.1","2.1.12-stable-9ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.12-stable-10build2","2.1.13-stable-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.12-stable-10build1","2.1.12-stable-10build2","2.1.12-stable-10ubuntu0.1","2.1.12-stable-10ubuntu0.2"]}],"products":[{"vendor":"libevent","product":"libevent"}],"references":[{"url":"https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/libevent/libevent/commit/825c18bd99f556b59d61200523237f264d5cc734","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63380","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63380.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63380","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63380","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-63380","title":"Libevent: Null Pointer Dereference in `evws_new_session`","description":"Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server-\u003ews_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.","status":"published","published":"2026-08-20T17:52:29.458Z","modified":"2026-08-25T15:11:16.746Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-416","CWE-476"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-63506","description":"Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server-\u003ews_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.","status":"published","published":"2026-08-20T17:52:29Z","modified":"2026-08-25T15:11:16Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:32.944243Z"}],"nvd":[{"id":"CVE-2026-63380","description":"Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server-\u003ews_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.","status":"published","published":"2026-08-20T18:16:35.357Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-416","CWE-476"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"CVE-2026-63380","title":"Libevent: Null Pointer Dereference in `evws_new_session`","description":"Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server-\u003ews_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.","status":"published","published":"2026-08-20T17:52:29.458Z","modified":"2026-10-28T11:17:04.925561336Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-416","CWE-476"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"UBUNTU-CVE-2026-63380","description":"Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server-\u003ews_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.","status":"published","published":"2026-08-20T18:16:00Z","modified":"2026-10-17T13:00:32.276383476Z","cvss":[{"version":"4.0","score":5.7,"vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"AZL-96912","title":"CVE-2026-63380 affecting package libtevent 0.14.1-1","description":"Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server-\u003ews_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.","status":"published","published":"2026-08-20T18:16:35Z","modified":"2026-10-22T05:37:13Z","updated_at":"2026-11-02T15:28:12.313414Z"}]}}