Libevent
Monthly
Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables remote attackers to crash or corrupt processes that use the library's DNS handling functions. The dnsname_to_labels() function in evdns.c mishandles the boundary check when writing DNS labels into a 64KB stack buffer - the terminating null byte is written one position past the allocated buffer to buf[buf_len] whenever a name-bearing record aligns precisely at the boundary. Any application embedding libevent's evdns module and querying an attacker-influenced DNS server is in scope; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of service without authentication. The flaw arises in evtag_unmarshal_header, where a uint32 payload length decoded from attacker-controlled input is implicitly cast to a signed int; values exceeding INT_MAX produce negative or truncated results that flow into allocation sizing in evtag_unmarshal_string, causing a wrapped allocation request and crash. No active exploitation has been confirmed (not in CISA KEV), but the network-accessible, unauthenticated attack surface and a publicly available upstream fix make this a straightforward patching priority for any consumer of the libevent evtag interface.
Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privileged caller to crash the hosting process by inducing a locking failure. When evhttp_start_ws_ succeeds but bufferevent_enable_locking_ subsequently fails, the cleanup function evws_connection_free calls TAILQ_REMOVE on a list the session was never inserted into, dereferencing an invalid pointer. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in 2.2.2-alpha.
HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha line prior to 2.2.2-alpha, letting an unauthenticated remote attacker desynchronize request boundaries when libevent sits behind a differently-framing proxy. Because evhttp mishandles duplicate and comma-listed Transfer-Encoding headers and accepts bare-LF chunk terminators, a smuggled second request can bypass proxy-enforced access controls or poison shared caches. No public exploit identified at time of analysis, and this is not listed in CISA KEV; a vendor patch is available.
Use-after-free memory corruption in libevent's evbuffer_add_buffer_reference (buffer.c) allows a caller that can drive a specific empty-buffer state to trigger process crashes or heap corruption in any application linking the library. Affected are libevent stable releases before 2.1.13 and development releases 2.2.0-alpha through 2.2.2-alpha; the root cause is that evbuffer_free_all_chains frees the initial empty chain without nullifying the three outbuf chain-tracking pointers, after which APPEND_CHAIN_MULTICAST dereferences the now-dangling pointer. No public exploit code and no active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for both stable and alpha branches.
Memory exhaustion in libevent's WebSocket server (ws.c) allows unauthenticated remote clients to crash affected processes by sending an unbounded stream of fragmented WebSocket frames. Affected versions span 2.2.0-alpha-dev through pre-fix 2.2.2-alpha; the evws WebSocket API enforces WS_MAX_RECV_FRAME_SZ per individual frame but applies no cap to the total accumulated message size in evws->incomplete_frames, enabling heap growth without limit. No public exploit has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog; however, exploitation is trivially simple for any WebSocket client.
Out-of-bounds read in libevent's tagged RPC decoder crashes any application that decodes attacker-controlled tag data using the evbuffer API, affecting all 2.1.x releases prior to 2.1.13 and all 2.2.x alpha releases prior to 2.2.2-alpha. The flaw in decode_tag_internal causes the byte-iteration loop to walk the full logical buffer length while only a smaller pullup window is physically contiguous, allowing a crafted 6-byte fragmented tag to drive reads past valid memory and abort the process. No active exploitation is confirmed and no public proof-of-concept exists; fixed releases are available on GitHub and should be applied promptly given libevent's broad embedding across network-facing software.
Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener to corrupt heap memory, achieving full confidentiality, integrity, and availability impact. Release builds compiled with -DNDEBUG silently remove the EVUTIL_ASSERT length guard, causing memcpy to write a kernel-supplied 110-byte sockaddr_un into the 28-byte conn_address union field and overwriting the adjacent dns_request heap pointer. No public exploit has been identified at time of analysis, but the absence of privilege requirements and low attack complexity make this accessible to any local process with filesystem access to the socket path.
The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Off-by-one stack buffer overflow in Libevent's evdns component (versions prior to 2.1.13-stable and 2.2.2-alpha) enables remote attackers to crash or corrupt processes that use the library's DNS handling functions. The dnsname_to_labels() function in evdns.c mishandles the boundary check when writing DNS labels into a 64KB stack buffer - the terminating null byte is written one position past the allocated buffer to buf[buf_len] whenever a name-bearing record aligns precisely at the boundary. Any application embedding libevent's evdns module and querying an attacker-influenced DNS server is in scope; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Integer overflow in Libevent's event tagging subsystem exposes any application using the evtag API to remote denial of service without authentication. The flaw arises in evtag_unmarshal_header, where a uint32 payload length decoded from attacker-controlled input is implicitly cast to a signed int; values exceeding INT_MAX produce negative or truncated results that flow into allocation sizing in evtag_unmarshal_string, causing a wrapped allocation request and crash. No active exploitation has been confirmed (not in CISA KEV), but the network-accessible, unauthenticated attack surface and a publicly available upstream fix make this a straightforward patching priority for any consumer of the libevent evtag interface.
Use-after-free in libevent's WebSocket session initialization (ws.c) before version 2.2.2-alpha allows a local low-privileged caller to crash the hosting process by inducing a locking failure. When evhttp_start_ws_ succeeds but bufferevent_enable_locking_ subsequently fails, the cleanup function evws_connection_free calls TAILQ_REMOVE on a list the session was never inserted into, dereferencing an invalid pointer. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in 2.2.2-alpha.
HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha line prior to 2.2.2-alpha, letting an unauthenticated remote attacker desynchronize request boundaries when libevent sits behind a differently-framing proxy. Because evhttp mishandles duplicate and comma-listed Transfer-Encoding headers and accepts bare-LF chunk terminators, a smuggled second request can bypass proxy-enforced access controls or poison shared caches. No public exploit identified at time of analysis, and this is not listed in CISA KEV; a vendor patch is available.
Use-after-free memory corruption in libevent's evbuffer_add_buffer_reference (buffer.c) allows a caller that can drive a specific empty-buffer state to trigger process crashes or heap corruption in any application linking the library. Affected are libevent stable releases before 2.1.13 and development releases 2.2.0-alpha through 2.2.2-alpha; the root cause is that evbuffer_free_all_chains frees the initial empty chain without nullifying the three outbuf chain-tracking pointers, after which APPEND_CHAIN_MULTICAST dereferences the now-dangling pointer. No public exploit code and no active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available for both stable and alpha branches.
Memory exhaustion in libevent's WebSocket server (ws.c) allows unauthenticated remote clients to crash affected processes by sending an unbounded stream of fragmented WebSocket frames. Affected versions span 2.2.0-alpha-dev through pre-fix 2.2.2-alpha; the evws WebSocket API enforces WS_MAX_RECV_FRAME_SZ per individual frame but applies no cap to the total accumulated message size in evws->incomplete_frames, enabling heap growth without limit. No public exploit has been identified at time of analysis, and the vulnerability is absent from the CISA KEV catalog; however, exploitation is trivially simple for any WebSocket client.
Out-of-bounds read in libevent's tagged RPC decoder crashes any application that decodes attacker-controlled tag data using the evbuffer API, affecting all 2.1.x releases prior to 2.1.13 and all 2.2.x alpha releases prior to 2.2.2-alpha. The flaw in decode_tag_internal causes the byte-iteration loop to walk the full logical buffer length while only a smaller pullup window is physically contiguous, allowing a crafted 6-byte fragmented tag to drive reads past valid memory and abort the process. No active exploitation is confirmed and no public proof-of-concept exists; fixed releases are available on GitHub and should be applied promptly given libevent's broad embedding across network-facing software.
Heap out-of-bounds write in libevent's bufferevent_sock.c allows any local peer connecting to an AF_UNIX evhttp listener to corrupt heap memory, achieving full confidentiality, integrity, and availability impact. Release builds compiled with -DNDEBUG silently remove the EVUTIL_ASSERT length guard, causing memcpy to write a kernel-supplied 110-byte sockaddr_un into the 28-byte conn_address union field and overwriting the adjacent dns_request heap pointer. No public exploit has been identified at time of analysis, but the absence of privilege requirements and low attack complexity make this accessible to any local process with filesystem access to the socket path.
The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via an empty hostname. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Stack-based buffer overflow in the evutil_parse_sockaddr_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (segmentation fault) via vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.