Skip to content
OpenAdvisories
High RHSA-2026:60853 5 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published Aug 30, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 libevent 0:2.1.12-19.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libevent-devel 0:2.1.12-19.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libevent-doc 0:2.1.12-19.1.hum1

Vulnerabilities 5

  • High 8.7
    CVE-2026-63383

    Libevent: decode_tag_internal() can lead to out-of-bounds read

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical …

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-63384

    Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-63388

    Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_add…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-63379

    Libevent: HTTP Header smuggling

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trai…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • Medium 5.8
    CVE-2026-63381

    Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty c…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-63379
  • report
    https://access.redhat.com/security/cve/CVE-2026-63381
  • report
    https://access.redhat.com/security/cve/CVE-2026-63383
  • report
    https://access.redhat.com/security/cve/CVE-2026-63384
  • report
    https://access.redhat.com/security/cve/CVE-2026-63388
  • article
    https://access.redhat.com/security/updates/classification/
  • article
    https://images.redhat.com/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60853.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520667
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63379
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63379
  • article
    https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636
  • article
    https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485
  • article
    https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
  • article
    https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
  • article
    https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520657
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63381
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63381
  • article
    https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c
  • article
    https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9
  • article
    https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520654
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63383
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63383
  • article
    https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321
  • article
    https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb
  • article
    https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520658
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63384
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63384
  • article
    https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda
  • article
    https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416
  • article
    https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520661
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63388
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63388
  • article
    https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9
  • article
    https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72