https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-17T07:21:55.131245+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/alsa-2026:67908 ALSA-2026:67908 — Important: libevent security update 2026-10-17T07:21:55.176707+00:00

Affected: AlmaLinux:8: libevent, AlmaLinux:8: libevent-devel, AlmaLinux:8: libevent-doc

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383) * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387) * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384) * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382) * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388) * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://db.gcve.eu/vuln/bdu:2026-12661 bdu:2026-12661 2026-10-17T07:21:55.176834+00:00 bdu:2026-12661 https://db.gcve.eu/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-17T07:21:55.176858+00:00 certfr-2026-avi-1233 https://db.gcve.eu/vuln/fkie_cve-2026-63384 fkie_cve-2026-63384 2026-10-17T07:21:55.176877+00:00

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

 https://db.gcve.eu/vuln/gcve-1988-2026-0383 GCVE-1988-2026-0383 — [Bugtraq] [SECURITY] [DSA 6493-1] libevent security update 2026-10-17T07:21:55.176903+00:00

Affected: unknown libevent security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6493-1 security@debian.org https://www.debian.org/security/ Aron Xu September 11, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libevent CVE ID : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383 CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388 Several vulnerabilities were discovered in libevent, an asynchronous event notification library. The HTTP implementation (evhttp) handled Transfer-Encoding and Content-Length headers, chunked-encoding line terminators, header line folding and chunked trailers too permissively, which could allow HTTP request smuggling, header injection or access control bypass when a libevent-based server or client is combined with an HTTP proxy. Out-of-bounds memory accesses in the DNS (evdns), tagged RPC (evtag/evrpc) and buffered socket (bufferevent) code, and a use-after-free in evbuffer, could result in denial of service or potentially the execution of arbitrary code when processing untrusted input. For the stable distribution (trixie), these problems have been fixed in version 2.1.13-stable-1~deb13u1. We recommend that you upgrade your libevent packages. For the detailed security status of libevent please refer t…

 https://db.gcve.eu/vuln/msrc_cve-2026-63384 msrc_CVE-2026-63384 — Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value. 2026-10-17T07:21:55.176951+00:00 msrc_CVE-2026-63384 https://db.gcve.eu/vuln/oesa-2026-3268 OESA-2026-3268 — libevent security update 2026-10-17T07:21:55.176971+00:00

Affected: openEuler:24.03-LTS-SP4: libevent, openEuler:20.03-LTS-SP4: libevent, openEuler:22.03-LTS-SP4: libevent, openEuler:24.03-LTS-SP1: libevent, openEuler:24.03-LTS-SP3: libevent

Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor. Security Fix(es):

The updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)

The updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)

The updated packages fix some security vulnerabilities.(CVE-2026-63382)

The updated packages fix some security vulnerabilities.(CVE-2026-63383)

The updated packages fix some security vulnerabilities.(CVE-2026-63384)

The updated packages fix some security vulnerabilities.(CVE-2026-63385)

The updated packages fix some security vulnerabilities.(CVE-2026-63387)

The updated packages fix some security vulnerabilities.(CVE-2026-63388)

 https://db.gcve.eu/vuln/rhsa-2026:60853 RHSA-2026:60853 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-17T07:21:55.177010+00:00

libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning libevent: Libevent: Memory corruption due to use-after-free libevent: Libevent: Denial of Service via malformed RPC data libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

 https://db.gcve.eu/vuln/rhsa-2026:67908 RHSA-2026:67908 — Red Hat Security Advisory: libevent security update 2026-10-17T07:21:55.177040+00:00

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling libevent: Libevent: Denial of Service via malformed RPC data libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` libevent: Libevent: HTTP header handling bugs create risk of access control bypass. libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

 https://db.gcve.eu/vuln/ubuntu-cve-2026-63384 UBUNTU-CVE-2026-63384 2026-10-17T07:21:55.177070+00:00

Affected: Ubuntu:Pro:14.04:LTS: libevent, Ubuntu:Pro:16.04:LTS: libevent, Ubuntu:Pro:18.04:LTS: libevent, Ubuntu:Pro:20.04:LTS: libevent, Ubuntu:22.04:LTS: libevent, Ubuntu:24.04:LTS: libevent, Ubuntu:26.04:LTS: libevent

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.