Skip to main content

Libevent CVE-2026-63387

| EUVDEUVD-2026-63508 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-08-20 GitHub_M
Stack Overflow Buffer Overflow Libevent Red Hat
7.0
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.0 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
vuln.today AI
6.5 MEDIUM

AV:N because crafted DNS response traverses the network; AC:H for precise 64KB buffer-fill requirement; C:N because a single null-byte write does not expose memory contents.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
8.6 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 20, 2026 - 18:26 vuln.today
Analysis Generated
Aug 20, 2026 - 18:26 vuln.today
Patch available
Aug 20, 2026 - 18:03 EUVD
CVE Published
Aug 20, 2026 - 17:53 cve.org
HIGH 7.0

DescriptionCVE.org

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

AnalysisAI

Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables remote attackers to crash or corrupt processes that use the library's DNS handling functions. The dnsname_to_labels() function in evdns.c mishandles the boundary check when writing DNS labels into a 64KB stack buffer - the terminating null byte is written one position past the allocated buffer to buf[buf_len] whenever a name-bearing record aligns precisely at the boundary. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application uses libevent's evdns module to process DNS server responses - applications that do not invoke evdns are unaffected by this specific flaw. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 7.0 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H reflects a network-reachable flaw where high attack complexity (AC:H) is the primary risk-dampening factor: reliable exploitation requires a crafted DNS response whose encoded name labels are sized to reach exactly the 64KB boundary, a precision constraint that varies by environment and makes mass exploitation unlikely. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to libevent 2.1.13-stable (for 2.1.x deployments) or libevent 2.2.2-alpha (for 2.2.x pre-release deployments); both releases contain the confirmed fix for GHSA-58rx-7448-jw47. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all production systems and applications that embed the Libevent library and have DNS functionality enabled, prioritizing internet-facing services. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Libevent

View all
CVE-2016-10195 CRITICAL POC
9.8 Mar 15

The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via

CVE-2016-10197 HIGH POC
7.5 Mar 15

The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out
CVE-2016-10196 HIGH POC
7.5 Mar 15

Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows

CVE-2026-63382 CRITICAL
9.2 Aug 20

HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha l
CVE-2026-63384 HIGH
8.7 Aug 20

Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of s
CVE-2026-63383 HIGH
8.7 Aug 20

Out-of-bounds read in libevent's tagged RPC decoder crashes any application that decodes attacker-controlled tag data us
CVE-2026-63388 HIGH
8.4 Aug 20

Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener
CVE-2014-6272 HIGH
7.5 Aug 24

Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.
CVE-2015-6525 HIGH
7.5 Aug 24

Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context
CVE-2026-63495 HIGH
7.5 Aug 20

Memory exhaustion in libevent's WebSocket server (ws.c) allows unauthenticated remote clients to crash affected processe
CVE-2026-63381 MEDIUM
5.8 Aug 20

Use-after-free memory corruption in libevent's evbuffer_add_buffer_reference (buffer.c) allows a caller that can drive a
CVE-2026-63380 MEDIUM
5.7 Aug 20

Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privi

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Stack Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

Share

CVE-2026-63387 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy