Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
libevent could read bad data or overflow memory
published 15 days ago
Summary
The libevent library used in Red Hat systems can mishandle certain inputs, leading to memory errors that might cause crashes or allow data to be read incorrectly. Update the libevent packages to the latest version to protect your servers from these issues.
What to do
- Update redhat libevent to version 2.0.21-4.el7.tuxcare.els2.
- Update redhat libevent-devel to version 2.0.21-4.el7.tuxcare.els2.
- Update redhat libevent-doc to version 2.0.21-4.el7.tuxcare.els2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:RHEL:7 | redhat | libevent |
< 2.0.21-4.el7.tuxcare.els2 Fix: upgrade to 2.0.21-4.el7.tuxcare.els2
|
| TuxCare:RHEL:7 | redhat | libevent-devel |
< 2.0.21-4.el7.tuxcare.els2 Fix: upgrade to 2.0.21-4.el7.tuxcare.els2
|
| TuxCare:RHEL:7 | redhat | libevent-doc |
< 2.0.21-4.el7.tuxcare.els2 Fix: upgrade to 2.0.21-4.el7.tuxcare.els2
|
Original advisory text
libevent: Fix of 5 CVEs
- CVE-2026-63383: fix out-of-bounds read in decode_tag_internal
- CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
- CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
- CVE-2026-63385: reject HTTP header values containing CR or LF
- CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing
- CVE-2026-63384: reject payload lengths above INT_MAX in evtag_unmarshal_header
- CVE-2026-63387: fix off-by-one stack buffer overflow in dnsname_to_labels
- CVE-2026-63385: reject HTTP header values containing CR or LF
- CVE-2026-63382: reject ambiguous Transfer-Encoding/Content-Length headers and require CRLF in chunked framing
References
- https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792536579.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63382 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63383 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63384 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63385 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63387 Vendor Advisory
Timeline
Published20 Oct 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1792536579 · OSV
Track software like this
Free during beta