Most recent entries from all

ALSA-2026:67908 — Important: libevent security update

Affected: AlmaLinux:8: libevent, AlmaLinux:8: libevent-devel, AlmaLinux:8: libevent-doc

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383) * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387) * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384) * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382) * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388) * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2026-12660

certfr-2026-avi-1233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1233

fkie_cve-2026-63383

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

GCVE-1988-2026-0383 — [Bugtraq] [SECURITY] [DSA 6493-1] libevent security update

Affected: unknown libevent security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6493-1 security@debian.org https://www.debian.org/security/ Aron Xu September 11, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libevent CVE ID : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383 CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388 Several vulnerabilities were discovered in libevent, an asynchronous event notification library. The HTTP implementation (evhttp) handled Transfer-Encoding and Content-Length headers, chunked-encoding line terminators, header line folding and chunked trailers too permissively, which could allow HTTP request smuggling, header injection or access control bypass when a libevent-based server or client is combined with an HTTP proxy. Out-of-bounds memory accesses in the DNS (evdns), tagged RPC (evtag/evrpc) and buffered socket (bufferevent) code, and a use-after-free in evbuffer, could result in denial of service or potentially the execution of arbitrary code when processing untrusted input. For the stable distribution (trixie), these problems have been fixed in version 2.1.13-stable-1~deb13u1. We recommend that you upgrade your libevent packages. For the detailed security status of libevent please refer t…

msrc_CVE-2026-63383 — Libevent: decode_tag_internal() can lead to out-of-bounds read

msrc_CVE-2026-63383

OESA-2026-3268 — libevent security update

Affected: openEuler:24.03-LTS-SP4: libevent, openEuler:20.03-LTS-SP4: libevent, openEuler:22.03-LTS-SP4: libevent, openEuler:24.03-LTS-SP1: libevent, openEuler:24.03-LTS-SP3: libevent

Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor. Security Fix(es):

The updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)

The updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)

The updated packages fix some security vulnerabilities.(CVE-2026-63382)

The updated packages fix some security vulnerabilities.(CVE-2026-63383)

The updated packages fix some security vulnerabilities.(CVE-2026-63384)

The updated packages fix some security vulnerabilities.(CVE-2026-63385)

The updated packages fix some security vulnerabilities.(CVE-2026-63387)

The updated packages fix some security vulnerabilities.(CVE-2026-63388)

RHSA-2026:60853 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning libevent: Libevent: Memory corruption due to use-after-free libevent: Libevent: Denial of Service via malformed RPC data libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

RHSA-2026:67908 — Red Hat Security Advisory: libevent security update

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling libevent: Libevent: Denial of Service via malformed RPC data libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` libevent: Libevent: HTTP header handling bugs create risk of access control bypass. libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

UBUNTU-CVE-2026-63383

Affected: Ubuntu:Pro:14.04:LTS: libevent, Ubuntu:Pro:16.04:LTS: libevent, Ubuntu:Pro:18.04:LTS: libevent, Ubuntu:Pro:20.04:LTS: libevent, Ubuntu:22.04:LTS: libevent, Ubuntu:24.04:LTS: libevent, Ubuntu:26.04:LTS: libevent