AZL-96912
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-96912.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-96912
- Upstream
- Published
- 2026-08-20T18:16:35Z
- Modified
- 2026-08-30T05:24:52Z
- Summary
- CVE-2026-63380 affecting package libtevent 0.14.1-1
- Details
-
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evwsnewsession enters its error path after evhttpstartws_ succeeds but buffereventenablelocking_ fails. evwsconnectionfree sees a non-null httpserver and unconditionally calls TAILQREMOVE even though the session was never inserted into httpserver->wssessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.
- References