Skip to content
OpenAdvisories
High · 8.4 CVE-2026-63388 EUVD-2026-63501

Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept

Published Aug 20, 2026 · Updated Aug 21, 2026 · Assigned by GitHub_M

Vendor: libevent Product: libevent Package: libevent Package: libevent Package: libevent Package: libtevent Package: mysql Package: ntp Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Affected products

VendorProductAffectedFixed
libevent libevent < 2.1.13, >= 2.2.0-alpha, < 2.2.2-alpha —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libevent 2.1.13-stable-1 —
Debian 13 libevent 2.1.13-stable-1~deb13u1 —
Debian 12 libevent 2.1.12-stable-8+deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS libevent 2.1.12-stable-10ubuntu0.2 USN-8840-1
Ubuntu 24.04 LTS libevent 2.1.12-stable-9ubuntu2.2 USN-8840-1
Ubuntu 22.04 LTS libevent 2.1.12-stable-1ubuntu0.2 USN-8840-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS libevent 2.1.11-stable-1ubuntu0.1~esm2 USN-8840-1
Ubuntu Pro 18.04 LTS libevent 2.1.8-stable-4ubuntu0.1~esm2 USN-8840-1
Ubuntu Pro 16.04 LTS libevent 2.0.21-stable-2ubuntu0.16.04.1+esm2 USN-8840-1
Ubuntu Pro 14.04 LTS libevent 2.0.21-stable-1ubuntu1.14.04.2+esm2 USN-8840-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 libevent +2 2.1.13-1.el10_2 RHSA-2026:67909
RHEL 9 libevent +2 2.1.13-1.el9_8 RHSA-2026:67910
RHEL 8 libevent +2 2.1.8-11.el8_10 RHSA-2026:67908
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 libevent +2 2.1.12-19.1.hum1 RHSA-2026:60853

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 libevent +2 2.1.13-1.el10_2 ALSA-2026:67909
AlmaLinux 9 libevent +2 2.1.13-1.el9_8 ALSA-2026:67910
AlmaLinux 8 libevent +2 2.1.8-11.el8_10 ALSA-2026:67908

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 libevent 2.1.13-1.el10_2 RLSA-2026:67909
Rocky Linux 9 libevent 2.1.13-1.el9_8 RLSA-2026:67910
Rocky Linux 8 libevent 2.1.8-11.el8_10 RLSA-2026:67908

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libevent 2.1.13-1.1 openSUSE-SU-2026:12330-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libevent 2.1.13-1 —
Azure Linux 3 libtevent No fix yet —
Azure Linux 3 mysql 8.0.46-2 —
Azure Linux 3 ntp 4.2.8p17-3 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 libevent +2 2.1.13-1.el10_2 ELSA-2026-67909
Oracle Linux 9 libevent +2 2.1.13-1.el9_8 ELSA-2026-67910
Oracle Linux 8 libevent +2 2.1.8-11.el8_10 ELSA-2026-67908

Advisories 18

References