CVE-2026-63383

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63383", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T17:39:30.171Z", "datePublished": "2026-08-20T17:48:24.568Z", "dateUpdated": "2026-08-20T18:41:23.897Z"}, "containers": {"cna": {"title": "Libevent: decode_tag_internal() can lead to out-of-bounds read", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"}, {"name": "https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321"}, {"name": "https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb"}, {"name": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"}, {"name": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"}], "affected": [{"vendor": "libevent", "product": "libevent", "versions": [{"version": ">= 2.2.0-alpha, < 2.2.2-alpha", "status": "affected"}, {"version": "< 2.1.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T17:48:24.568Z"}, "descriptions": [{"lang": "en", "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}], "source": {"advisory": "GHSA-fj29-64w6-73h6", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T18:37:55.514994Z", "id": "CVE-2026-63383", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T18:41:23.897Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63383", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-16T17:39:30.171Z", "datePublished": "2026-08-20T17:48:24.568Z", "dateUpdated": "2026-08-20T18:41:23.897Z"}, "containers": {"cna": {"title": "Libevent: decode_tag_internal() can lead to out-of-bounds read", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"}, {"name": "https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321"}, {"name": "https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb"}, {"name": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"}, {"name": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha", "tags": ["x_refsource_MISC"], "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"}], "affected": [{"vendor": "libevent", "product": "libevent", "versions": [{"version": ">= 2.2.0-alpha, < 2.2.2-alpha", "status": "affected"}, {"version": "< 2.1.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-20T17:48:24.568Z"}, "descriptions": [{"lang": "en", "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}], "source": {"advisory": "GHSA-fj29-64w6-73h6", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63383", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T18:37:55.514994Z"}}}], "references": [{"url": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T18:40:02.691Z"}}]}}

{"affected": [{"affectedData": [{"product": "libevent", "vendor": "libevent", "versions": [{"status": "affected", "version": ">= 2.2.0-alpha, < 2.2.2-alpha"}, {"status": "affected", "version": "< 2.1.13"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}, {"lang": "es", "value": "Libevent es una biblioteca de notificaci\u00f3n de eventos. Antes de 2.1.13 y 2.2.2-alpha, libevent puede leer m\u00e1s all\u00e1 de una regi\u00f3n contigua de evbuffer en event_tagging.c cuando decode_tag_internal solicita como m\u00e1ximo cinco bytes de evbuffer_pullup pero itera usando la longitud completa del b\u00fafer l\u00f3gico. Un evbuffer fragmentado que contiene una etiqueta malformada de seis bytes puede, por lo tanto, avanzar m\u00e1s all\u00e1 de la ventana de pullup y desencadenar una lectura fuera de l\u00edmites, lo que puede bloquear un proceso que decodifica datos RPC etiquetados controlados por el atacante. Este problema est\u00e1 solucionado en las versiones 2.1.13 y 2.2.2-alpha."}], "id": "CVE-2026-63383", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63383", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T18:37:55.514994Z", "version": "2.0.3"}}]}, "published": "2026-08-20T18:16:35.917", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"}, {"source": "security-advisories@github.com", "url": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libevent: Libevent: Denial of Service via malformed RPC data", "id": "2520654", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520654"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.", "A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the `decode_tag_internal()` function by sending specially crafted, attacker-controlled tagged RPC (Remote Procedure Call) data. This could lead to a denial of service, causing the process that decodes the data to crash."], "name": "CVE-2026-63383", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "libevent2", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "libevent", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-20T17:48:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63383\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63383\nhttps://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321\nhttps://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb\nhttps://github.com/libevent/libevent/releases/tag/release-2.1.13-stable\nhttps://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha\nhttps://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0-alpha,2.2.2-alpha)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.13)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "libevent", "source": "cna", "vendor": "libevent"}, "product": "libevent", "vendor": "libevent_project"}], "created": "2026-08-21T02:15:04.424872+00:00", "updated": "2026-08-21T13:01:18.312049+00:00", "vendors": ["libevent_project", "libevent_project$PRODUCT$libevent"]}