Skip to content
OpenAdvisories
High ALSA-2026:67909 8 CVEs

Important: libevent security update

Published Sep 16, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
* libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
* libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
* libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)
* libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
* libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
* libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
* libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 3

ReleasePackageFixed in
AlmaLinux · 10 libevent 2.1.13-1.el10_2
AlmaLinux · 10 libevent-devel 2.1.13-1.el10_2
AlmaLinux · 10 libevent-doc 2.1.13-1.el10_2

Vulnerabilities 8

  • Critical 9.2
    CVE-2026-63382

    libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evht…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • Critical 9.2
    CVE-2026-63385

    Libevent: HTTP header handling bugs create risk of access control bypass.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string opera…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-63383

    Libevent: decode_tag_internal() can lead to out-of-bounds read

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical …

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-63384

    Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-63388

    Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_add…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-63387

    Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_req…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-63379

    Libevent: HTTP Header smuggling

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trai…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • Medium 5.8
    CVE-2026-63381

    Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty c…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-63379
  • report
    https://access.redhat.com/security/cve/CVE-2026-63381
  • report
    https://access.redhat.com/security/cve/CVE-2026-63382
  • report
    https://access.redhat.com/security/cve/CVE-2026-63383
  • report
    https://access.redhat.com/security/cve/CVE-2026-63384
  • report
    https://access.redhat.com/security/cve/CVE-2026-63385
  • report
    https://access.redhat.com/security/cve/CVE-2026-63387
  • report
    https://access.redhat.com/security/cve/CVE-2026-63388
  • report
    https://bugzilla.redhat.com/2520654
  • report
    https://bugzilla.redhat.com/2520655
  • report
    https://bugzilla.redhat.com/2520657
  • report
    https://bugzilla.redhat.com/2520658
  • report
    https://bugzilla.redhat.com/2520661
  • report
    https://bugzilla.redhat.com/2520666
  • report
    https://bugzilla.redhat.com/2520667
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-67909.html