Skip to content
OpenAdvisories
Critical RHSA-2026:67908 6 CVEs

Red Hat Security Advisory: libevent security update

Published Sep 17, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 7

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream libevent-debuginfo 0:2.1.8-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream libevent-debugsource 0:2.1.8-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::appstream libevent-devel 0:2.1.8-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos libevent 0:2.1.8-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos libevent-debuginfo 0:2.1.8-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos libevent-debugsource 0:2.1.8-11.el8_10
Red Hat · RHEL 8 enterprise_linux:8::baseos libevent-doc 0:2.1.8-11.el8_10

Vulnerabilities 6

  • Critical 9.2
    CVE-2026-63382

    libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evht…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • Critical 9.2
    CVE-2026-63385

    Libevent: HTTP header handling bugs create risk of access control bypass.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string opera…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-63383

    Libevent: decode_tag_internal() can lead to out-of-bounds read

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical …

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-63384

    Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-63388

    Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_add…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-63387

    Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_req…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520654
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520655
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520658
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520660
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520661
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520666
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67908.json
  • report
    https://access.redhat.com/security/cve/CVE-2026-63382
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63382
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63382
  • article
    https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6
  • article
    https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e
  • article
    https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660
  • article
    https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0
  • article
    https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
  • article
    https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
  • article
    https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j
  • report
    https://access.redhat.com/security/cve/CVE-2026-63383
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63383
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63383
  • article
    https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321
  • article
    https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb
  • article
    https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6
  • report
    https://access.redhat.com/security/cve/CVE-2026-63384
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63384
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63384
  • article
    https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda
  • article
    https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416
  • article
    https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8
  • report
    https://access.redhat.com/security/cve/CVE-2026-63385
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63385
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63385
  • article
    https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0
  • article
    https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2
  • article
    https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2
  • report
    https://access.redhat.com/security/cve/CVE-2026-63387
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63387
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63387