Critical Security Flaw in libevent: Denial of Service and Code Execution Vulnerabilities
Summary
RLSA-2026:67910: Important: libevent security update. Affects libevent versions < 0:2.1.13-1.el9_8. Fixed in 0:2.1.13-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libevent is an asynchronous event notification library that provides a mechanism to execute a callback function when a specific event occurs on a file descriptor or after a timeout. It is widely used in network programming and applications requiring high performance and scalability. However, recent vulnerabilities have been identified that could lead to severe security risks, including denial of service and arbitrary code execution.
Vulnerability Detail
The vulnerabilities in libevent stem from various issues, including a denial of service via malformed RPC data (CVE-2026-63383), an off-by-one stack buffer overflow leading to potential data corruption (CVE-2026-63387), and memory corruption due to use-after-free (CVE-2026-63381). Additionally, there are integer conversion errors in evtag_unmarshal_header that can cause denial of service (CVE-2026-63384), multiple HTTP parser bugs that enable request smuggling (CVE-2026-63382), and arbitrary code execution via heap out-of-bounds writes in AF_UNIX handling (CVE-2026-63388). These vulnerabilities can lead to access control bypass, cache poisoning, and other critical security breaches.
How To Fix
Minimum fixed version
0:2.1.13-1.el9_8
This is the first release that contains the fix.
sudo dnf update libeventTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting access to the affected services or implementing additional network security measures to filter out malformed requests until the package can be updated.
Conclusion
The vulnerabilities identified in libevent pose significant risks, including denial of service and arbitrary code execution. It is crucial for users to update to the latest patched version to safeguard their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for libevent →
FAQ
libevent is an asynchronous event notification library that allows applications to execute callback functions when specific events occur, such as I/O operations or timeouts.
The main vulnerabilities include denial of service, arbitrary code execution, memory corruption, and HTTP header handling bugs that can lead to access control bypass.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities. Simply upload your manifest file, such as package-lock.json, to check for vulnerabilities.
The CVSS score for the vulnerabilities in libevent is 8.6, indicating a high severity level.
If an immediate update is not possible, implement network security measures to filter out potentially malicious requests and limit access to affected services.
References
Related vulnerabilities
Recent vulnerabilities recorded for libevent.
