Summary
Alexis Challande discovered that libevent incorrectly handled certain
empty output buffers. An attacker could possibly use this issue to
trigger a use-after-free, resulting in a denial of service or arbitrary
code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04
LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-63381)
Rajat Raghav discovered that libevent incorrectly handled certain HTTP
requests. An attacker could possibly use this issue to desynchronize
HTTP request boundaries, resulting in HTTP request smuggling.
(CVE-2026-63382)
Qiu Sihao discovered that libevent incorrectly handled certain malformed
tagged RPC data. An attacker could possibly use this issue to trigger an
out-of-bounds read, resulting in a denial of service. (CVE-2026-63383)
Qiu Sihao discovered that libevent incorrectly handled certain large
payload lengths in tagged RPC data. An attacker could possibly use this
issue to consume excessive system resources, resulting in a denial of
service. (CVE-2026-63384)
Asaf Meizner discovered that libevent incorrectly handled certain HTTP
URIs and header values. An attacker could possibly use this issue to
cause HTTP messages to be interpreted inconsistently, resulting in
security restrictions being bypassed. (CVE-2026-63385)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libevent | 2.1.12-stable-1ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | libevent | 2.1.12-stable-9ubuntu2.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | libevent | 2.1.12-stable-10ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libevent | 2.0.21-stable-1ubuntu1.14.04.2+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libevent | 2.0.21-stable-2ubuntu0.16.04.1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libevent | 2.1.8-stable-4ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | libevent | 2.1.11-stable-1ubuntu0.1~esm1 |
Vulnerabilities 5
-
Critical 9.2
libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evht…
-
Critical 9.2
Libevent: HTTP header handling bugs create risk of access control bypass.
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string opera…
-
High 8.7
Libevent: decode_tag_internal() can lead to out-of-bounds read
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical …
-
High 8.7
Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it…
-
Medium 5.8
Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty c…