CVE-2026-63384

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63384
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63384.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63384
Aliases
  • GHSA-45c6-qx49-89m8
Downstream
ALSA (3)
AZL (4)
BELL (1)
CLSA (4)
DEBIAN (1)
ECHO (1)
MGASA (1)
OESA (1)
openSUSE (1)
RHSA (4)
RLSA (3)
ROOT (3)
UBUNTU (1)
Related
ALSA (3)
openSUSE (1)
Published
2026-08-20T17:53:08Z
Modified
2026-10-29T12:27:01Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.
Details

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-190"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63384.json"
}
References

Affected packages

Git / github.com/libevent/libevent

Affected ranges

Type
GIT
Repo
https://github.com/libevent/libevent
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
df3ecad3a040fd6d4fad4287defe113395de6fd7
Fixed
79ddfb460847999b807cba76d04e73891f29c6ee
Fixed
109c16499282959d70f56ec3baf4c8b1e6646bda
Fixed
5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.2.0-alpha"
                },
                {
                    "fixed":  "2.2.2-alpha"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.1.13"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "109c16499282959d70f56ec3baf4c8b1e6646bda"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "release-2.1.13-stable",
            "range":  [
                {
                    "fixed":  "79ddfb460847999b807cba76d04e73891f29c6ee"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "release-2.2.2-alpha",
            "range":  [
                {
                    "fixed":  "df3ecad3a040fd6d4fad4287defe113395de6fd7"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

release-1.*
release-1.1b
release-2.*
release-2.0.1-alpha
release-2.0.10-stable
release-2.0.3-alpha
release-2.0.4-alpha
release-2.0.5-beta
release-2.0.6-rc
release-2.0.7-rc
release-2.0.8-rc
release-2.0.9-rc
release-2.1.1-alpha
release-2.1.10-stable
release-2.1.11-stable
release-2.1.12-stable
release-2.1.2-alpha
release-2.1.3-alpha
release-2.1.4-alpha
release-2.1.5-beta
release-2.1.6-beta
release-2.1.7-rc
release-2.1.8-stable
release-2.1.9-beta
release-2.2.1-alpha

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63384.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "65618021557916598666749967159040448195",
            "length":  250
        },
        "id":  "CVE-2026-63384-05d7cf03",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda",
        "target":  {
            "file":  "event_tagging.c",
            "function":  "evtag_unmarshal_header"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "159443554126248192493229143747497657830",
            "length":  554
        },
        "id":  "CVE-2026-63384-09212634",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7",
        "target":  {
            "file":  "test/regress_http.c",
            "function":  "http_check_transfer_encoding_test"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "65618021557916598666749967159040448195",
            "length":  250
        },
        "id":  "CVE-2026-63384-79cf092b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416",
        "target":  {
            "file":  "event_tagging.c",
            "function":  "evtag_unmarshal_header"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "130688092411103881779793319185293442532",
                "35591852254511256822037719077016828240",
                "149333174035468761482274091843112180090",
                "167782302790249760667996112209708432798"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63384-91b26bd8",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda",
        "target":  {
            "file":  "event_tagging.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "270762094980121927552802584929566056086",
                "37564212311334647331345684303177453724",
                "168570413533780985513641597969239978857"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63384-923050c6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7",
        "target":  {
            "file":  "test/regress_http.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "270762094980121927552802584929566056086",
                "37564212311334647331345684303177453724",
                "168570413533780985513641597969239978857"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63384-979e5bed",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee",
        "target":  {
            "file":  "test/regress_http.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "130688092411103881779793319185293442532",
                "35591852254511256822037719077016828240",
                "149333174035468761482274091843112180090",
                "167782302790249760667996112209708432798"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-63384-b9e1d770",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416",
        "target":  {
            "file":  "event_tagging.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "159443554126248192493229143747497657830",
            "length":  554
        },
        "id":  "CVE-2026-63384-ebc5ab94",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee",
        "target":  {
            "file":  "test/regress_http.c",
            "function":  "http_check_transfer_encoding_test"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:12:02Z"