Description
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| libevent | libevent | < 2.2.2-alpha | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libevent | No fix yet | — |
| Ubuntu 26.04 LTS | libevent | No fix yet | — |
| Ubuntu 24.04 LTS | libevent | No fix yet | — |
| Ubuntu 22.04 LTS | libevent | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | libevent | No fix yet | — |
| Ubuntu Pro 18.04 LTS | libevent | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libevent | No fix yet | — |
| Ubuntu Pro 14.04 LTS | libevent | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libtevent | No fix yet | — |