Skip to main content

Libevent CVE-2026-63384

| EUVDEUVD-2026-63507 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-08-20 GitHub_M
Integer Overflow Denial Of Service Libevent Suse
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable with no auth or user interaction; impact is availability-only (DoS via allocation crash), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 20, 2026 - 18:26 vuln.today
Analysis Generated
Aug 20, 2026 - 18:26 vuln.today
Patch available
Aug 20, 2026 - 18:03 EUVD
CVE Published
Aug 20, 2026 - 17:53 cve.org
HIGH 8.7

DescriptionCVE.org

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

AnalysisAI

Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of service without authentication. The flaw arises in evtag_unmarshal_header, where a uint32 payload length decoded from attacker-controlled input is implicitly cast to a signed int; values exceeding INT_MAX produce negative or truncated results that flow into allocation sizing in evtag_unmarshal_string, causing a wrapped allocation request and crash. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application uses libevent's evtag (event tagging/marshaling) API to process data received from an attacker-controlled source, such as a network peer or external input stream. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects the attack surface: no authentication, no special attack conditions, and a direct availability impact reachable over the network. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to libevent 2.1.13-stable (for 2.1.x users) or 2.2.2-alpha (for 2.2.x users); both are confirmed released at the GitHub release tags https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable and https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha respectively, with fix commits 109c16499282959d70f56ec3baf4c8b1e6646bda and 5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all applications using Libevent's evtag API by reviewing dependency manifests and vendor documentation to assess organizational exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libevent

View all
CVE-2016-10195 CRITICAL POC
9.8 Mar 15

The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via

CVE-2016-10197 HIGH POC
7.5 Mar 15

The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out
CVE-2016-10196 HIGH POC
7.5 Mar 15

Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows

CVE-2026-63382 CRITICAL
9.2 Aug 20

HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha l
CVE-2026-63383 HIGH
8.7 Aug 20

Out-of-bounds read in libevent's tagged RPC decoder crashes any application that decodes attacker-controlled tag data us
CVE-2026-63388 HIGH
8.4 Aug 20

Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener
CVE-2014-6272 HIGH
7.5 Aug 24

Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.
CVE-2015-6525 HIGH
7.5 Aug 24

Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context
CVE-2026-63495 HIGH
7.5 Aug 20

Memory exhaustion in libevent's WebSocket server (ws.c) allows unauthenticated remote clients to crash affected processe
CVE-2026-63387 HIGH
7.0 Aug 20

Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables
CVE-2026-63381 MEDIUM
5.8 Aug 20

Use-after-free memory corruption in libevent's evbuffer_add_buffer_reference (buffer.c) allows a caller that can drive a
CVE-2026-63380 MEDIUM
5.7 Aug 20

Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privi

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-63384 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy