Skip to content
OpenAdvisories
Critical RHSA-2026:70254 1 CVE

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 6, 2026 · Updated Oct 20, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 libevent 0:2.1.13-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libevent-devel 0:2.1.13-1.hum1
Red Hat · Hardened Images 1 hummingbird:1 libevent-doc 0:2.1.13-1.hum1

Vulnerabilities 1

  • Critical 9.2
    CVE-2026-63385

    Libevent: HTTP header handling bugs create risk of access control bypass.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string opera…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-63385
  • article
    https://access.redhat.com/security/updates/classification/
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_70254.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2520666
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-63385
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-63385
  • article
    https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0
  • article
    https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2
  • article
    https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
  • article
    https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
  • article
    https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2