Skip to main content

libevent CVE-2026-63383

| EUVDEUVD-2026-63502 HIGH
Out-of-bounds Read (CWE-125)
2026-08-20 GitHub_M
Information Disclosure Buffer Overflow Libevent Suse
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable, no auth required, no complexity; pure availability impact (process crash), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 20, 2026 - 18:27 vuln.today
Analysis Generated
Aug 20, 2026 - 18:27 vuln.today
Patch available
Aug 20, 2026 - 18:03 EUVD
CVE Published
Aug 20, 2026 - 17:48 cve.org
HIGH 8.7

DescriptionCVE.org

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

AnalysisAI

Out-of-bounds read in libevent's tagged RPC decoder crashes any application that decodes attacker-controlled tag data using the evbuffer API, affecting all 2.1.x releases prior to 2.1.13 and all 2.2.x alpha releases prior to 2.2.2-alpha. The flaw in decode_tag_internal causes the byte-iteration loop to walk the full logical buffer length while only a smaller pullup window is physically contiguous, allowing a crafted 6-byte fragmented tag to drive reads past valid memory and abort the process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application specifically invokes libevent's event tagging / tagged RPC subsystem (the decode_tag_internal function in event_tagging.c) on data supplied or influenced by an attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) reflects a straightforward network-reachable denial-of-service with no complexity barriers and no authentication requirement, which is accurate for the class of exposure: any application exposing the libevent RPC tagging path to untrusted network input is directly vulnerable. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation The primary remediation is upgrading libevent to version 2.1.13-stable (for the 2.1.x branch) or 2.2.2-alpha (for the 2.2.x branch), both of which contain the corrected loop bound in decode_tag_internal; release artifacts are available at https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable and https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit your infrastructure to identify all services and applications embedding libevent by checking dependency manifests, container images, and vendor documentation. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libevent

View all
CVE-2016-10195 CRITICAL POC
9.8 Mar 15

The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via

CVE-2016-10197 HIGH POC
7.5 Mar 15

The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out
CVE-2016-10196 HIGH POC
7.5 Mar 15

Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows

CVE-2026-63382 CRITICAL
9.2 Aug 20

HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha l
CVE-2026-63384 HIGH
8.7 Aug 20

Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of s
CVE-2026-63388 HIGH
8.4 Aug 20

Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener
CVE-2014-6272 HIGH
7.5 Aug 24

Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.
CVE-2015-6525 HIGH
7.5 Aug 24

Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context
CVE-2026-63495 HIGH
7.5 Aug 20

Memory exhaustion in libevent's WebSocket server (ws.c) allows unauthenticated remote clients to crash affected processe
CVE-2026-63387 HIGH
7.0 Aug 20

Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables
CVE-2026-63381 MEDIUM
5.8 Aug 20

Use-after-free memory corruption in libevent's evbuffer_add_buffer_reference (buffer.c) allows a caller that can drive a
CVE-2026-63380 MEDIUM
5.7 Aug 20

Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privi

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-63383 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy