RLSA-2026:67909

libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header (CVE-2026-63384)
libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Database specific

{
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:67909"
}

References

Credits

- Rocky Enterprise Software Foundation
- Red Hat

Affected packages

Rocky Linux:10 / libevent

Package

Name: libevent
Purl: pkg:rpm/rocky-linux/libevent?distro=rocky-linux-10&epoch=0

Affected ranges

Type

ECOSYSTEM

Events

Introduced

Fixed

0:2.1.13-1.el10_2

Database specific

Show details

{
    "yum_repository": "BaseOS"
}

Database specific

source

"https://storage.googleapis.com/resf-osv-data/RLSA-2026:67909.json"