Skip to content
OpenAdvisories
High RHSA-2026:41176 1 CVE

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Aug 28, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 libevent 0:2.1.12-19.hum1
Red Hat · Hardened Images 1 hummingbird:1 libevent-devel 0:2.1.12-19.hum1
Red Hat · Hardened Images 1 hummingbird:1 libevent-doc 0:2.1.12-19.hum1

Vulnerabilities 1

  • High 7.5
    CVE-2026-63495

    Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames

    Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client ca…

    libevent libevent

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-63495
  • article
    https://access.redhat.com/security/updates/classification/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41176.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520659
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63495
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63495
  • article
    https://github.com/libevent/libevent/commit/291c4d1cd75695e898030ebd5c4ddf26c094077b
  • article
    https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
  • article
    https://github.com/libevent/libevent/security/advisories/GHSA-qx89-wf2v-vgmx