Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.0
CVE-2026-63387: Libevent can crash from crafted DNS response
CVE-2026-63387 · published 2 months ago
Summary
Versions of the Libevent library older than 2.1.13 (and older than 2.2.2‑alpha) can write one byte beyond a memory buffer when they process a specially crafted DNS reply. This can cause the application using Libevent to crash or behave unpredictably. Upgrade Libevent to version 2.1.13 or later (or 2.2.2‑alpha or later) to fix the issue.
What to do
- Update debian libevent to version 2.1.12-stable-1.aikido.2.
- Update debian rootio-libevent to version 2.1.12-stable-1.aikido.2.
- Update debian libevent to version 2.1.13-stable-1.
- Update debian libevent to version 2.1.12-stable-10.aikido.2.
- Update debian rootio-libevent to version 2.1.12-stable-10.aikido.2.
- Update bellsoft libevent to version 2.1.13-r0.
- Update libevent to version 2.1.12-stable-1.aikido.3.
- Update rootio-libevent to version 2.1.12-stable-1.aikido.3.
- Update debian libevent to version 2.1.12-stable-8+deb12u1.
- Update debian libevent to version 2.1.13-stable-1~deb13u1.
- Update canonical libevent to version 2.1.12-stable-10ubuntu0.2.
- Update libevent to version 2.1.12-stable-10.aikido.2.
- Update rootio-libevent to version 2.1.12-stable-10.aikido.2.
- Update libevent to version 2.1.12-stable-8.aikido.4.
- Update rootio-libevent to version 2.1.12-stable-8.aikido.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:26.04:LTS | canonical | libevent |
< 2.1.12-stable-10ubuntu0.2 Fix: upgrade to 2.1.12-stable-10ubuntu0.2
|
| Root:Debian:11 | debian | libevent |
< 2.1.12-stable-1.aikido.2 Fix: upgrade to 2.1.12-stable-1.aikido.2
|
| Root:Debian:11 | debian | rootio-libevent |
< 2.1.12-stable-1.aikido.2 Fix: upgrade to 2.1.12-stable-1.aikido.2
|
| – | libevent | libevent | >= 2.2.0-alpha, < 2.2.2-alpha |
| Debian:11 | debian | libevent | All versions |
| Debian:12 | debian | libevent |
< 2.1.12-stable-8+deb12u1 Fix: upgrade to 2.1.12-stable-8+deb12u1
|
| Debian:13 | debian | libevent |
< 2.1.13-stable-1~deb13u1 Fix: upgrade to 2.1.13-stable-1~deb13u1
|
| Debian:14 | debian | libevent |
< 2.1.13-stable-1 Fix: upgrade to 2.1.13-stable-1
|
| Ubuntu:14.04:LTS | canonical | libevent | All versions |
| Ubuntu:16.04:LTS | canonical | libevent | All versions |
| Ubuntu:18.04:LTS | canonical | libevent | All versions |
| Ubuntu:20.04:LTS | canonical | libevent | All versions |
| Ubuntu:22.04:LTS | canonical | libevent | All versions |
| Ubuntu:24.04:LTS | canonical | libevent | All versions |
| Root:Debian:13 | debian | libevent |
< 2.1.12-stable-10.aikido.2 Fix: upgrade to 2.1.12-stable-10.aikido.2
|
| Root:Debian:13 | debian | rootio-libevent |
< 2.1.12-stable-10.aikido.2 Fix: upgrade to 2.1.12-stable-10.aikido.2
|
| BellSoft Hardened Containers:23 | bellsoft | libevent |
>= 2.1.12-r5, < 2.1.13-r0 Fix: upgrade to 2.1.13-r0
|
| BellSoft Hardened Containers:25 | bellsoft | libevent |
>= 2.1.12-r8, < 2.1.13-r0 Fix: upgrade to 2.1.13-r0
|
| BellSoft Hardened Containers:stream | bellsoft | libevent |
>= 2.1.12-r4, < 2.1.13-r0 Fix: upgrade to 2.1.13-r0
|
| Alpaquita:23 | bellsoft | libevent |
>= 2.1.12-r5, < 2.1.13-r0 Fix: upgrade to 2.1.13-r0
|
| Alpaquita:25 | bellsoft | libevent |
>= 2.1.12-r8, < 2.1.13-r0 Fix: upgrade to 2.1.13-r0
|
| Alpaquita:stream | bellsoft | libevent |
>= 2.1.12-r4, < 2.1.13-r0 Fix: upgrade to 2.1.13-r0
|
| Root:Debian:11 | – | libevent |
< 2.1.12-stable-1.aikido.3 Fix: upgrade to 2.1.12-stable-1.aikido.3
|
| Root:Debian:11 | – | rootio-libevent |
< 2.1.12-stable-1.aikido.3 Fix: upgrade to 2.1.12-stable-1.aikido.3
|
| Root:Debian:13 | – | libevent |
< 2.1.12-stable-10.aikido.2 Fix: upgrade to 2.1.12-stable-10.aikido.2
|
| Root:Debian:13 | – | rootio-libevent |
< 2.1.12-stable-10.aikido.2 Fix: upgrade to 2.1.12-stable-10.aikido.2
|
| Root:Debian:12 | – | libevent |
< 2.1.12-stable-8.aikido.4 Fix: upgrade to 2.1.12-stable-8.aikido.4
|
| Root:Debian:12 | – | rootio-libevent |
< 2.1.12-stable-8.aikido.4 Fix: upgrade to 2.1.12-stable-8.aikido.4
|
Original advisory text
Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
References
- https://ubuntu.com/security/CVE-2026-63387 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-63387 Third Party Advisory
- https://docs.bell-sw.com/security/cves/CVE-2026-63387 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-63387 Vendor Advisory
- https://ubuntu.com/security/notices/USN-8840-1 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63387 Vendor Advisory
- https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63387... Vendor Advisory
- https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47 Vendor Advisory
- https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha URL
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-121Stack-based Buffer Overflow
CWE-193Off-by-one Error
CWE-787Out-of-bounds Write
Timeline
Published20 Aug 2026
Updated4 Nov 2026
First seen20 Aug 2026
Sources
CVE-2026-63387 · NVD
CVE-2026-63387 · MITRE
CVE-2026-63387 · OSV
GHSA-58rx-7448-jw47 · GHSA
UBUNTU-CVE-2026-63387 · OSV
DEBIAN-CVE-2026-63387 · OSV
BELL-CVE-2026-63387 · OSV
Track software like this
Free during beta