Skip to content
OpenAdvisories
High WID-SEC-2026-3419 12 CVEs

Red Hat Enterprise Linux (corosync, libevent, libsoup): Mehrere Schwachstellen

Published Sep 16, 2026 · Updated Nov 12, 2026 · Revision 24 · de

Vendor: amazon Vendor: Debian Vendor: Fedora Vendor: IBM Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Vendor: Ubuntu Product: AIX Product: Enterprise Linux Product: i Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux 2 Product: MQ Product: openSUSE Product: QRadar SIEM Product: Rocky Linux Product: VIOS Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände herbeizuführen.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 12

  • Critical 9.2
    CVE-2026-63382

    libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evht…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • Critical 9.2
    CVE-2026-63385

    Libevent: HTTP header handling bugs create risk of access control bypass.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string opera…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-63383

    Libevent: decode_tag_internal() can lead to out-of-bounds read

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical …

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.7
    CVE-2026-63384

    Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 8.4
    CVE-2026-63388

    Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_add…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • High 7.6
    CVE-2026-85197

    Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload

    A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-15709

    Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service

    A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop (inflate()) processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limi…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-15711

    Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation

    A vulnerability was found in libsoup's WebSocket frame parsing implementation. The library fails to validate length rules specified in RFC 6455 §5.5, which mandates that all WebSocket control frames (e.g., PING, PONG, CLOSE) contain a payload of 125 bytes or …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-81665

    Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

    A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent at…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2026-63387

    Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_req…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2026-63379

    Libevent: HTTP Header smuggling

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trai…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux
  • Medium 5.8
    CVE-2026-63381

    Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty c…

    libevent libevent mysql libevent Debian Ubuntu Azure Linux

Revision history

  1. #24

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  2. #23

    Neue Updates von Red Hat aufgenommen

  3. #22

    Neue Updates von SUSE und Red Hat aufgenommen

  4. #21

    Neue Updates von SUSE aufgenommen

  5. #20

    Neue Updates von openSUSE aufgenommen

  6. #19

    Neue Updates von Red Hat aufgenommen

  7. #18

    Neue Updates von Fedora und SUSE aufgenommen

  8. #17

    Neue Updates von IBM, openSUSE und Ubuntu aufgenommen

  9. #16

    Neue Updates von SUSE aufgenommen

  10. #15

    Neue Updates von SUSE aufgenommen

  11. #14

    Neue Updates von Oracle Linux aufgenommen

  12. #13

    Neue Updates von Red Hat und IBM aufgenommen

  13. #12

    Neue Updates von SUSE aufgenommen

  14. #11

    Neue Updates von Ubuntu aufgenommen

  15. #10

    Neue Updates von SUSE und Ubuntu aufgenommen

  16. #9

    Neue Updates von Amazon aufgenommen

  17. #8

    Neue Updates von SUSE aufgenommen

  18. #7

    Neue Updates von SUSE, Oracle Linux und openSUSE aufgenommen

  19. #6

    Neue Updates von Red Hat aufgenommen

  20. #5

    Neue Updates von SUSE, Red Hat, Rocky Enterprise Software Foundation und openSUSE aufgenommen

  21. #4

    Neue Updates von SUSE und Red Hat aufgenommen

  22. #3

    Neue Updates von Red Hat, Oracle Linux und Debian aufgenommen

  23. #2

    Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

  24. #1

    Initiale Fassung

References