Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
libevent may crash or be exploited by large messages
published 1 month ago
Summary
The libevent library used in several Ubuntu packages can mis‑handle unusually large or malformed data, leading to memory overflows and out‑of‑bounds reads. This can cause the application to crash or, in rare cases, allow an attacker to run code. Install the latest security updates for the libevent packages from your distribution as soon as possible.
What to do
- Update canonical libevent-2.1-6 to version 2.1.8-stable-4build1+tuxcare.els1.
- Update canonical libevent-core-2.1-6 to version 2.1.8-stable-4build1+tuxcare.els1.
- Update canonical libevent-dev to version 2.1.8-stable-4build1+tuxcare.els1.
- Update canonical libevent-extra-2.1-6 to version 2.1.8-stable-4build1+tuxcare.els1.
- Update canonical libevent-openssl-2.1-6 to version 2.1.8-stable-4build1+tuxcare.els1.
- Update canonical libevent-pthreads-2.1-6 to version 2.1.8-stable-4build1+tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Ubuntu:18.04 | canonical | libevent-2.1-6 |
< 2.1.8-stable-4build1+tuxcare.els1 Fix: upgrade to 2.1.8-stable-4build1+tuxcare.els1
|
| TuxCare:Ubuntu:18.04 | canonical | libevent-core-2.1-6 |
< 2.1.8-stable-4build1+tuxcare.els1 Fix: upgrade to 2.1.8-stable-4build1+tuxcare.els1
|
| TuxCare:Ubuntu:18.04 | canonical | libevent-dev |
< 2.1.8-stable-4build1+tuxcare.els1 Fix: upgrade to 2.1.8-stable-4build1+tuxcare.els1
|
| TuxCare:Ubuntu:18.04 | canonical | libevent-extra-2.1-6 |
< 2.1.8-stable-4build1+tuxcare.els1 Fix: upgrade to 2.1.8-stable-4build1+tuxcare.els1
|
| TuxCare:Ubuntu:18.04 | canonical | libevent-openssl-2.1-6 |
< 2.1.8-stable-4build1+tuxcare.els1 Fix: upgrade to 2.1.8-stable-4build1+tuxcare.els1
|
| TuxCare:Ubuntu:18.04 | canonical | libevent-pthreads-2.1-6 |
< 2.1.8-stable-4build1+tuxcare.els1 Fix: upgrade to 2.1.8-stable-4build1+tuxcare.els1
|
Original advisory text
Fix CVE(s): CVE-2026-63383, CVE-2026-63384
* SECURITY UPDATE: integer overflow in evtag_unmarshal_header()
- debian/patches/CVE-2026-63384.patch: reject payload lengths above
INT_MAX in event_tagging.c, include/event2/tag.h
- CVE-2026-63384
* SECURITY UPDATE: out-of-bounds read in decode_tag_internal()
- debian/patches/CVE-2026-63383.patch: bound the tag decoding loop by the
pulled-up length instead of the full buffer length in event_tagging.c
- CVE-2026-63383
- debian/patches/CVE-2026-63384.patch: reject payload lengths above
INT_MAX in event_tagging.c, include/event2/tag.h
- CVE-2026-63384
* SECURITY UPDATE: out-of-bounds read in decode_tag_internal()
- debian/patches/CVE-2026-63383.patch: bound the tag decoding loop by the
pulled-up length instead of the full buffer length in event_tagging.c
- CVE-2026-63383
References
- https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1790251955.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63383 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63384 Vendor Advisory
Timeline
Published24 Sep 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1790251955 · OSV
Track software like this
Free during beta