Skip to content
OpenAdvisories
High ELSA-2026-67908 6 CVEs

Important: libevent security update (Oracle Linux 8)

Published Sep 17, 2026 · Updated Sep 17, 2026

Ecosystem: Oracle Linux

Summary

[2.1.8-11]
- Fix CVE-2026-63385: HTTP header injection via CRLF in header values
- Resolves: RHEL-253566

[2.1.8-10]
- Fix CVE-2026-63387: out-of-bounds write in evdns dnsname_to_labels
- Resolves: RHEL-249889

[2.1.8-9]
- Fix CVE-2026-63383: out-of-bounds read in decode_tag_internal
- Resolves: RHEL-250240

[2.1.8-8]
- Fix CVE-2026-63384: integer overflow in evtag_unmarshal_header
- Resolves: RHEL-250071

[2.1.8-7]
- Fix CVE-2026-63388: heap out-of-bounds write via AF_UNIX+http+NDEBUG
- Resolves: RHEL-250045

[2.1.8-6]
- Fix CVE-2026-63382: HTTP request smuggling via Transfer-Encoding
- Resolves: RHEL-253525

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 8 libevent 0:2.1.8-11.el8_10
Oracle Linux · 8 libevent-devel 0:2.1.8-11.el8_10
Oracle Linux · 8 libevent-doc 0:2.1.8-11.el8_10

Vulnerabilities 6

  • Critical 9.2
    CVE-2026-63382

    libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evht…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • Critical 9.2
    CVE-2026-63385

    Libevent: HTTP header handling bugs create risk of access control bypass.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string opera…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-63383

    Libevent: decode_tag_internal() can lead to out-of-bounds read

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical …

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-63384

    Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-63388

    Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_add…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-63387

    Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_req…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux