Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`
Priority LOW 25CWE-908Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · High
- Fix status
- Partial Red Hat: 7 fixed, 5 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00121 1st percentileScored 2026-11-07
Fix Partial libevent (libevent): 2.2.2-alpha, 2.1.13Red Hat: 10 advisoriesRed Hat: 7 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA libevent (libevent) Fixed in 2.2.2-alpha, 2.1.13
Red Hat 10 advisories
- RHSA-2026:72476 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
- RHSA-2026:72470 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
Show 7 more Red Hat advisories
- RHSA-2026:72399 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
- RHSA-2026:72394 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:71603 Released 2026-09-24 · Red Hat rating ImportantRed Hat Update Infrastructure 5.3 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
- RHSA-2026:67910 Released 2026-09-16 · Red Hat rating Importantlibevent security update
- Red Hat Enterprise Linux AppStream (v. 9) libevent-devel-2.1.13-1.el9_8, libevent-doc-2.1.13-1.el9_8
- Red Hat Enterprise Linux BaseOS (v. 9) libevent-2.1.13-1.el9_8
- RHSA-2026:67909 Released 2026-09-16 · Red Hat rating Importantlibevent security update
- Red Hat Enterprise Linux AppStream (v. 10) libevent-devel-2.1.13-1.el10_2, libevent-doc-2.1.13-1.el10_2
- Red Hat Enterprise Linux BaseOS (v. 10) libevent-2.1.13-1.el10_2
- RHSA-2026:60853 Released 2026-08-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images libevent-2.1.12-19.1.hum1@aarch64, libevent-2.1.12-19.1.hum1@src, libevent-2.1.12-19.1.hum1@x86_64 +4
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet: Fix deferred |
| Cert Manager support for Red Hat OpenShift release 1.20 | Fixed | RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:67909 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:67910 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:67909 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:67910 |
| Red Hat Hardened Images | Fixed | RHSA-2026:60853 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:71603 |
Not affected: 2 products
- Cert Manager support for Red Hat OpenShift release 1.20
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63381
- 2026-11-03 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
Other 5
- https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8
- https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c
- https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9
- https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
- https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
More libevent vulnerabilities
- TI-2026-45182 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling CVSS 4.0CRITICAL 9.2
- TI-2026-45184 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value. CVSS 4.0HIGH 8.7
- TI-2026-45183 Libevent: decode_tag_internal() can lead to out-of-bounds read CVSS 4.0HIGH 8.7
- TI-2026-45237 Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames CVSS 3.1HIGH 7.5
- TI-2026-45187 Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response CVSS 3.1HIGH 7.0
- TI-2026-45180 Libevent: Null Pointer Dereference in `evws_new_session` CVSS 4.0MEDIUM 5.7
Sources
- CVE-2026-63381 · CVE Program
- CVE-2026-63381 · NVD
- FIRST EPSS
- CVE-2026-63381 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences