{"id":"CVE-2026-63388","aliases":["ALSA-2026:67908","ALSA-2026:67909","ALSA-2026:67910","AZL-96909","AZL-96956","AZL-97518","AZL-97563","BELL-CVE-2026-63388","DEBIAN-CVE-2026-63388","EUVD-2026-63501","GHSA-cvq5-vrvr-j338","MGASA-2026-0294","OESA-2026-3268","RHSA-2026:60853","RHSA-2026:67908","RHSA-2026:67909","RHSA-2026:67910","RLSA-2026:67908","RLSA-2026:67909","RLSA-2026:67910","ROOT-OS-DEBIAN-11-CVE-2026-63388","ROOT-OS-DEBIAN-12-CVE-2026-63388","ROOT-OS-DEBIAN-13-CVE-2026-63388","UBUNTU-CVE-2026-63388","USN-8840-1","openSUSE-SU-2026:12330-1"],"status":"published","title":"Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","severity":{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00142,"percentile":0.03542,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617","CWE-787"],"published":"2026-07-24T16:09:36Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libevent","fixed_in":["2.1.13-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"mysql","fixed_in":["8.0.46-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"ntp","fixed_in":["4.2.8p17-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libevent","fixed_in":["2.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libevent","fixed_in":["2.1.13-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libevent","fixed_in":["2.1.13-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"libevent","fixed_in":["2.1.13-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"libevent","fixed_in":["2.1.13-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"libevent","fixed_in":["2.1.13-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libevent","fixed_in":["2.1.12-stable-8+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libevent","fixed_in":["2.1.13-stable-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libevent","fixed_in":["2.1.13-stable-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"libevent","fixed_in":["2.1.12-stable-1.aikido.2","2.1.12-stable-1.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-libevent","fixed_in":["2.1.12-stable-1.aikido.2","2.1.12-stable-1.aikido.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libevent","fixed_in":["2.1.8-stable-4ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libevent","fixed_in":["2.1.11-stable-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libevent","fixed_in":["2.1.12-stable-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libevent","fixed_in":["2.1.12-stable-9ubuntu2.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libevent","fixed_in":["2.1.12-stable-10ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libevent-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libevent-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libevent-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libevent-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libevent-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libevent-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Azure Linux:3","package":"libtevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.14.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.46-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"ntp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.8p17-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.12-r5"},{"fixed":"2.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.12-r8"},{"fixed":"2.1.13-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.12-r4"},{"fixed":"2.1.13-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.12-r5"},{"fixed":"2.1.13-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.12-r8"},{"fixed":"2.1.13-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.12-r4"},{"fixed":"2.1.13-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-stable-8+deb12u1"}]}],"versions":["2.1.12-stable-8"]},{"source":"osv","ecosystem":"Debian:13","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-stable-1~deb13u1"}]}],"versions":["2.1.12-stable-10"]},{"source":"osv","ecosystem":"Debian:14","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-stable-1"}]}],"versions":["2.1.12-stable-10","2.1.13-stable-1~deb13u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-1.mga10"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:9","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-1.mga9"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-17.oe2403sp4"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-7.oe2003sp4"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-11.oe2203sp4"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-17.oe2403sp1"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-17.oe2403sp3"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.12-19.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libevent-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.12-19.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libevent-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.12-19.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libevent-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libevent-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libevent-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libevent-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libevent-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libevent-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libevent-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libevent-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libevent-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libevent-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libevent-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libevent-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libevent-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libevent-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libevent-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libevent-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.8-11.el8_10"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:10","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el10_2"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:9","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.13-1.el9_8"}]}],"bundled":8},{"source":"osv","ecosystem":"Root:Debian:11","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-stable-1.aikido.2"},{"fixed":"2.1.12-stable-1.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-stable-1.aikido.2"},{"fixed":"2.1.12-stable-1.aikido.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-stable-4ubuntu0.1~esm2"}]}],"versions":["2.1.8-stable-4","2.1.8-stable-4build1","2.1.8-stable-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-stable-1ubuntu0.1~esm2"}]}],"versions":["2.1.8-stable-4build1","2.1.11-stable-1~exp0","2.1.11-stable-1","2.1.11-stable-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-stable-1ubuntu0.2"}]}],"versions":["2.1.12-stable-1","2.1.12-stable-1build1","2.1.12-stable-1build2","2.1.12-stable-1build3","2.1.12-stable-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-stable-9ubuntu2.2"}]}],"versions":["2.1.12-stable-9","2.1.12-stable-9ubuntu2","2.1.12-stable-9ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-stable-10ubuntu0.2"}]}],"versions":["2.1.12-stable-10build1","2.1.12-stable-10build2","2.1.12-stable-10ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.21-stable-1ubuntu1.14.04.2+esm2"}]}],"versions":["2.0.21-stable-1","2.0.21-stable-1ubuntu1","2.0.21-stable-1ubuntu1.14.04.1","2.0.21-stable-1ubuntu1.14.04.2","2.0.21-stable-1ubuntu1.14.04.2+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.21-stable-2ubuntu0.16.04.1+esm2"}]}],"versions":["2.0.21-stable-2","2.0.21-stable-2ubuntu0.16.04.1","2.0.21-stable-2ubuntu0.16.04.1+esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.8-stable-4ubuntu0.1~esm2"}]}],"versions":["2.1.8-stable-4","2.1.8-stable-4build1","2.1.8-stable-4ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-stable-1ubuntu0.1~esm2"}]}],"versions":["2.1.8-stable-4build1","2.1.11-stable-1~exp0","2.1.11-stable-1","2.1.11-stable-1ubuntu0.1~esm1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-stable-1ubuntu0.2"}]}],"versions":["2.1.12-stable-1","2.1.12-stable-1build1","2.1.12-stable-1build2","2.1.12-stable-1build3","2.1.12-stable-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-stable-9ubuntu2.2"}]}],"versions":["2.1.12-stable-9","2.1.12-stable-9ubuntu2","2.1.12-stable-9ubuntu2.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.12-stable-10ubuntu0.2"}]}],"versions":["2.1.12-stable-10build1","2.1.12-stable-10build2","2.1.12-stable-10ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.13-1.1"}]}],"bundled":8}],"products":[{"vendor":"libevent","product":"libevent"}],"references":[{"url":"https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338","tags":["x_refsource_CONFIRM","advisory","article"]},{"url":"https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72","tags":["x_refsource_MISC","fix","article"]},{"url":"https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","tags":["x_refsource_MISC","web","article"]},{"url":"https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","tags":["x_refsource_MISC","web","article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67908","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63382","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63383","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63384","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63385","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63387","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63388","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520654","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520655","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520658","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520661","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520666","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-67908.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67909","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63379","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-63381","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520657","tags":["report"]},{"url":"https://bugzilla.redhat.com/2520667","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-67909.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67910","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-67910.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63388","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-63388","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63388.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63388","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0294.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35801","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/07/01/8","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3268","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63381","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63382","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63384","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63385","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63387","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60853","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60853.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520667","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63379","tags":["advisory"]},{"url":"https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636","tags":["article"]},{"url":"https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485","tags":["article"]},{"url":"https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520657","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63381","tags":["advisory"]},{"url":"https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c","tags":["article"]},{"url":"https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9","tags":["article"]},{"url":"https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520654","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63383","tags":["advisory"]},{"url":"https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321","tags":["article"]},{"url":"https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb","tags":["article"]},{"url":"https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63384","tags":["advisory"]},{"url":"https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda","tags":["article"]},{"url":"https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416","tags":["article"]},{"url":"https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520661","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63388","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520655","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520660","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2520666","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67908.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63382","tags":["advisory"]},{"url":"https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6","tags":["article"]},{"url":"https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e","tags":["article"]},{"url":"https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660","tags":["article"]},{"url":"https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0","tags":["article"]},{"url":"https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63385","tags":["advisory"]},{"url":"https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0","tags":["article"]},{"url":"https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2","tags":["article"]},{"url":"https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63387","tags":["advisory"]},{"url":"https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67909.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67910.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67908","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67909","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67910","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63388","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8840-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63387","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63388","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-63388","title":"Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","status":"published","published":"2026-08-20T17:44:18.435Z","modified":"2026-08-21T21:46:40.675Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-617","CWE-787"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-63501","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","status":"published","published":"2026-08-20T17:44:18Z","modified":"2026-08-21T21:46:40Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:36.505605Z"}],"nvd":[{"id":"CVE-2026-63388","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","status":"published","published":"2026-08-20T18:16:36.893Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-617","CWE-787"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"BELL-CVE-2026-63388","status":"published","published":"2026-08-22T06:05:48.622344Z","modified":"2026-09-01T07:15:05.375730492Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.959902Z"},{"id":"CVE-2026-63388","title":"Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","status":"published","published":"2026-08-20T17:44:18.435Z","modified":"2026-10-29T12:27:03.39932542Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-617","CWE-787"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-63388","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","status":"published","published":"2026-08-20T18:16:36.893Z","modified":"2026-10-27T09:47:34.49364814Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"OESA-2026-3268","title":"libevent security update","description":"Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor.\r\n\r\nSecurity Fix(es):\n\nThe updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)\n\nThe updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63382)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63383)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63384)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63385)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63387)\n\nThe updated packages fix some security vulnerabilities.(CVE-2026-63388)","status":"published","published":"2026-08-07T02:42:54Z","modified":"2026-08-07T03:00:59.366562112Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:60853","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-30T10:06:48Z","modified":"2026-10-06T10:31:29.343769134Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:67908","title":"Red Hat Security Advisory: libevent security update","status":"published","published":"2026-09-17T10:18:08Z","modified":"2026-10-20T10:14:05Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67909","title":"Red Hat Security Advisory: libevent security update","status":"published","published":"2026-09-17T10:18:08Z","modified":"2026-10-20T10:14:05Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67910","title":"Red Hat Security Advisory: libevent security update","status":"published","published":"2026-09-17T10:18:09Z","modified":"2026-10-20T10:14:06Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:67908","title":"Important: libevent security update","description":"The libevent packages provide an abstract asynchronous event notification library.\n\nSecurity Fix(es):\n\n* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)\n\n* libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)\n\n* libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)\n\n* libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)\n\n* libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)\n\n* libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-17T12:01:09.856303Z","modified":"2026-09-17T12:30:02.604191852Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:67909","title":"Important: libevent security update","description":"The libevent packages provide an abstract asynchronous event notification library.\n\nSecurity Fix(es):\n\n* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)\n\n* libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)\n\n* libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)\n\n* libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)\n\n* libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)\n\n* libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)\n\n* libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)\n\n* libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-17T12:09:45.694481Z","modified":"2026-09-17T12:30:02.601512822Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:67910","title":"Important: libevent security update","description":"The libevent packages provide an abstract asynchronous event notification library.\n\nSecurity Fix(es):\n\n* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)\n\n* libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)\n\n* libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)\n\n* libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)\n\n* libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)\n\n* libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)\n\n* libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)\n\n* libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-17T06:06:39.358579Z","modified":"2026-09-17T06:30:02.4765954Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-63388","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","status":"published","published":"2026-08-20T18:16:00Z","modified":"2026-09-29T23:41:58.825810999Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"ALSA-2026:67908","title":"Important: libevent security update","description":"The libevent packages provide an abstract asynchronous event notification library.  \n\nSecurity Fix(es):  \n\n  * libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)\n  * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)\n  * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)\n  * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)\n  * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)\n  * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-16T00:00:00Z","modified":"2026-10-29T11:02:29.408192493Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:67909","title":"Important: libevent security update","description":"The libevent packages provide an abstract asynchronous event notification library.  \n\nSecurity Fix(es):  \n\n  * libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)\n  * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)\n  * libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)\n  * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)\n  * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)\n  * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)\n  * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)\n  * libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-16T00:00:00Z","modified":"2026-10-29T11:30:42.313849733Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:67910","title":"Important: libevent security update","description":"The libevent packages provide an abstract asynchronous event notification library.  \n\nSecurity Fix(es):  \n\n  * libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)\n  * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)\n  * libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)\n  * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)\n  * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)\n  * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)\n  * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)\n  * libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-16T00:00:00Z","modified":"2026-10-29T11:32:32.034870974Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-96909","title":"CVE-2026-63388 affecting package libtevent 0.14.1-1","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","status":"published","published":"2026-08-20T18:16:36Z","modified":"2026-10-22T05:37:13Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"AZL-96956","title":"CVE-2026-63388 affecting package libevent for versions less than 2.1.13-1","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","status":"published","published":"2026-08-20T18:16:36Z","modified":"2026-09-10T14:17:04.819213395Z","updated_at":"2026-11-02T15:28:12.313414Z"},{"id":"AZL-97518","title":"CVE-2026-63388 affecting package mysql for versions less than 8.0.46-2","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","status":"published","published":"2026-08-20T18:16:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"AZL-97563","title":"CVE-2026-63388 affecting package ntp for versions less than 4.2.8p17-3","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","status":"published","published":"2026-08-20T18:16:36Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.280152Z"},{"id":"MGASA-2026-0294","title":"Updated libevent packages fix security vulnerabilities","description":"The updated packages fix some security vulnerabilities.\n","status":"published","published":"2026-07-24T16:09:36Z","modified":"2026-07-24T16:31:20.785884066Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12330-1","title":"libevent-2_1-7-2.1.13-1.1 on GA media","description":"These are all security issues fixed in the libevent-2_1-7-2.1.13-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-28T00:00:00Z","modified":"2026-10-29T12:15:05.385698679Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-63388","title":"CVE-2026-63388 in libevent - Patched by Root","description":"Root has patched CVE-2026-63388 in the libevent package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-09-16T09:41:22Z","modified":"2026-09-16T10:15:04.226025515Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-63388","title":"CVE-2026-63388 in libevent - Patched by Root","description":"Root has patched CVE-2026-63388 in the libevent package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-31T12:50:37Z","modified":"2026-10-09T13:00:14.214102392Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-63388","title":"CVE-2026-63388 in libevent - Patched by Root","description":"Root has patched CVE-2026-63388 in the libevent package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-31T06:15:59Z","modified":"2026-10-08T19:00:05.908478122Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"USN-8840-1","title":"libevent vulnerabilities","description":"Michał Majchrowicz and Marcin Wyczechowski discovered that libevent\nincorrectly handled certain DNS responses. A remote attacker could possibly\nuse this issue to cause a denial of service or execute arbitrary code.\n(CVE-2026-63387)\n\nIt was discovered that libevent incorrectly handled certain connections. A\nlocal attacker could possibly use this issue to cause a denial of service\nor execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-63388)","status":"published","published":"2026-09-28T20:05:19Z","modified":"2026-09-29T23:56:46.6606775Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}