Libevent: decode_tag_internal() can lead to out-of-bounds read
Priority HIGH 77CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 10 fixed, 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Partial libevent (libevent): 2.2.2-alpha, 2.1.13Red Hat: 12 advisoriesRed Hat: 10 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA libevent (libevent) Fixed in 2.2.2-alpha, 2.1.13
Red Hat 12 advisories
- RHSA-2026:89197 Released 2026-10-27 · Red Hat rating CriticalOpenShift Container Platform 4.22.20 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 rhcos-aarch64-4.22.9.8.202610241758-0, rhcos-ppc64le-4.22.9.8.202610241758-0, rhcos-s390x-4.22.9.8.202610241758-0 +1
- RHSA-2026:72476 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
Show 9 more Red Hat advisories
- RHSA-2026:72470 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:72399 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
- RHSA-2026:72394 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:71603 Released 2026-09-24 · Red Hat rating ImportantRed Hat Update Infrastructure 5.3 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
- RHSA-2026:67910 Released 2026-09-16 · Red Hat rating Importantlibevent security update
- Red Hat Enterprise Linux AppStream (v. 9) libevent-devel-2.1.13-1.el9_8, libevent-doc-2.1.13-1.el9_8
- Red Hat Enterprise Linux BaseOS (v. 9) libevent-2.1.13-1.el9_8
- RHSA-2026:67909 Released 2026-09-16 · Red Hat rating Importantlibevent security update
- Red Hat Enterprise Linux AppStream (v. 10) libevent-devel-2.1.13-1.el10_2, libevent-doc-2.1.13-1.el10_2
- Red Hat Enterprise Linux BaseOS (v. 10) libevent-2.1.13-1.el10_2
- RHSA-2026:67908 Released 2026-09-16 · Red Hat rating Importantlibevent security update
- Red Hat Enterprise Linux AppStream (v. 8) libevent-devel-2.1.8-11.el8_10
- Red Hat Enterprise Linux BaseOS (v. 8) libevent-2.1.8-11.el8_10, libevent-doc-2.1.8-11.el8_10
- RHSA-2026:60853 Released 2026-08-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images libevent-2.1.12-19.1.hum1@aarch64, libevent-2.1.12-19.1.hum1@src, libevent-2.1.12-19.1.hum1@x86_64 +4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Cert Manager support for Red Hat OpenShift release 1.20 | Fixed | RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:67909 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:67908 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:67910 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:67909 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:67908 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:67910 |
| Red Hat Hardened Images | Fixed | RHSA-2026:60853 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:89197 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:71603 |
Not affected: 2 products
- Cert Manager support for Red Hat OpenShift release 1.20
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63383
- 2026-10-28 Fix available: Red Hat OpenShift Container Platform 4.22 · Red Hat
- 2026-10-29 Fix available: RHSA-2026:89197 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
Other 5
- https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6
- https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321
- https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb
- https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
- https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
More libevent vulnerabilities
- TI-2026-45182 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling CVSS 4.0CRITICAL 9.2
- TI-2026-45184 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value. CVSS 4.0HIGH 8.7
- TI-2026-45237 Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames CVSS 3.1HIGH 7.5
- TI-2026-45187 Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response CVSS 3.1HIGH 7.0
- TI-2026-45180 Libevent: Null Pointer Dereference in `evws_new_session` CVSS 4.0MEDIUM 5.7
- TI-2026-45185 Libevent: HTTP header handling bugs create risk of access control bypass. CVSS 4.0CRITICAL 9.2
Sources
- CVE-2026-63383 · CVE Program
- CVE-2026-63383 · NVD
- FIRST EPSS
- CVE-2026-63383 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences