Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept
Priority LOW 37CWE-617Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 10 fixed, 4 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-617, CWE-787 and the CVSS impact.
Summary
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00142 3rd percentileScored 2026-11-07
Fix Partial libevent (libevent): 2.1.13, 2.2.2-alphaRed Hat: 12 advisoriesRed Hat: 10 fixed, 4 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA libevent (libevent) Fixed in 2.1.13, 2.2.2-alpha
Red Hat 12 advisories
- RHSA-2026:89197 Released 2026-10-27 · Red Hat rating CriticalOpenShift Container Platform 4.22.20 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 rhcos-aarch64-4.22.9.8.202610241758-0, rhcos-ppc64le-4.22.9.8.202610241758-0, rhcos-s390x-4.22.9.8.202610241758-0 +1
- RHSA-2026:72476 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
Show 9 more Red Hat advisories
- RHSA-2026:72470 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:72399 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
- RHSA-2026:72394 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:71603 Released 2026-09-24 · Red Hat rating ImportantRed Hat Update Infrastructure 5.3 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
- RHSA-2026:67910 Released 2026-09-16 · Red Hat rating Importantlibevent security update
- Red Hat Enterprise Linux AppStream (v. 9) libevent-devel-2.1.13-1.el9_8, libevent-doc-2.1.13-1.el9_8
- Red Hat Enterprise Linux BaseOS (v. 9) libevent-2.1.13-1.el9_8
- RHSA-2026:67909 Released 2026-09-16 · Red Hat rating Importantlibevent security update
- Red Hat Enterprise Linux AppStream (v. 10) libevent-devel-2.1.13-1.el10_2, libevent-doc-2.1.13-1.el10_2
- Red Hat Enterprise Linux BaseOS (v. 10) libevent-2.1.13-1.el10_2
- RHSA-2026:67908 Released 2026-09-16 · Red Hat rating Importantlibevent security update
- Red Hat Enterprise Linux AppStream (v. 8) libevent-devel-2.1.8-11.el8_10
- Red Hat Enterprise Linux BaseOS (v. 8) libevent-2.1.8-11.el8_10, libevent-doc-2.1.8-11.el8_10
- RHSA-2026:60853 Released 2026-08-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images libevent-2.1.12-19.1.hum1@aarch64, libevent-2.1.12-19.1.hum1@src, libevent-2.1.12-19.1.hum1@x86_64 +4
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix yet |
| Cert Manager support for Red Hat OpenShift release 1.20 | Fixed | RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:67909 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2026:67908 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:67910 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:67909 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2026:67908 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:67910 |
| Red Hat Hardened Images | Fixed | RHSA-2026:60853 |
| Red Hat OpenShift Container Platform 4.22 | Fixed | RHSA-2026:89197 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:71603 |
Not affected: 2 products
- Cert Manager support for Red Hat OpenShift release 1.20
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63388
- 2026-10-28 Fix available: Red Hat OpenShift Container Platform 4.22 · Red Hat
- 2026-10-29 Fix available: RHSA-2026:89197 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-11-06 Affected versions changed · Red Hat
References
Other 5
- https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338
- https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9
- https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72
- https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
- https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
More libevent vulnerabilities
- TI-2026-45182 libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling CVSS 4.0CRITICAL 9.2
- TI-2026-45184 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value. CVSS 4.0HIGH 8.7
- TI-2026-45183 Libevent: decode_tag_internal() can lead to out-of-bounds read CVSS 4.0HIGH 8.7
- TI-2026-45237 Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames CVSS 3.1HIGH 7.5
- TI-2026-45187 Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response CVSS 3.1HIGH 7.0
- TI-2026-45180 Libevent: Null Pointer Dereference in `evws_new_session` CVSS 4.0MEDIUM 5.7
Sources
- CVE-2026-63388 · CVE Program
- CVE-2026-63388 · NVD
- FIRST EPSS
- CVE-2026-63388 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences