Skip to content
OpenAdvisories
High · 8.7 CVE-2026-63383 EUVD-2026-63502

Libevent: decode_tag_internal() can lead to out-of-bounds read

Published Aug 20, 2026 · Updated Aug 20, 2026 · Assigned by GitHub_M

Vendor: libevent Product: libevent Package: libevent Package: libevent Package: libevent Package: libtevent Package: mysql Package: ntp Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Affected products

VendorProductAffectedFixed
libevent libevent >= 2.2.0-alpha, < 2.2.2-alpha, < 2.1.13 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libevent 2.1.13-stable-1 —
Debian 13 libevent 2.1.13-stable-1~deb13u1 —
Debian 12 libevent 2.1.12-stable-8+deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS libevent 2.1.12-stable-10ubuntu0.1 USN-8710-1
Ubuntu 24.04 LTS libevent 2.1.12-stable-9ubuntu2.1 USN-8710-1
Ubuntu 22.04 LTS libevent 2.1.12-stable-1ubuntu0.1 USN-8710-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libevent 2.1.11-stable-1ubuntu0.1~esm1 USN-8710-1
Ubuntu Pro 18.04 LTS libevent 2.1.8-stable-4ubuntu0.1~esm1 USN-8710-1
Ubuntu Pro 16.04 LTS libevent 2.0.21-stable-2ubuntu0.16.04.1+esm1 USN-8710-1
Ubuntu Pro 14.04 LTS libevent 2.0.21-stable-1ubuntu1.14.04.2+esm1 USN-8710-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 libevent +2 2.1.13-1.el10_2 RHSA-2026:67909
RHEL 9 libevent +2 2.1.13-1.el9_8 RHSA-2026:67910
RHEL 8 libevent +2 2.1.8-11.el8_10 RHSA-2026:67908
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 libevent +2 2.1.12-19.1.hum1 RHSA-2026:60853

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 libevent +2 2.1.13-1.el10_2 ALSA-2026:67909
AlmaLinux 9 libevent +2 2.1.13-1.el9_8 ALSA-2026:67910
AlmaLinux 8 libevent +2 2.1.8-11.el8_10 ALSA-2026:67908

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 libevent 2.1.13-1.el10_2 RLSA-2026:67909
Rocky Linux 9 libevent 2.1.13-1.el9_8 RLSA-2026:67910
Rocky Linux 8 libevent 2.1.8-11.el8_10 RLSA-2026:67908

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libevent 2.1.13-1.1 openSUSE-SU-2026:12330-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 libevent +2 2.1.12-3.amzn2023.0.4 ALAS2023-2026-2128
Amazon Linux 2 libevent +2 2.0.21-4.amzn2.0.4 ALAS2-2026-3902

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libevent 2.1.13-1 —
Azure Linux 3 libtevent No fix yet —
Azure Linux 3 mysql 8.0.46-2 —
Azure Linux 3 ntp 4.2.8p17-3 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 libevent +2 2.1.13-1.el10_2 ELSA-2026-67909
Oracle Linux 9 libevent +2 2.1.13-1.el9_8 ELSA-2026-67910
Oracle Linux 8 libevent +2 2.1.8-11.el8_10 ELSA-2026-67908

Advisories 18

References