CVE-2026-63380

UNKNOWN 0.0

Libevent: Null Pointer Dereference in `evws_new_session`

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.

CWE	CWE-416 CWE-476
Vendor	libevent
Product	libevent
Published	Aug 20, 2026

Stay Ahead of the Next One

Get instant alerts for libevent libevent

Be the first to know when new unknown vulnerabilities affecting libevent libevent are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

libevent / libevent

< 2.2.2-alpha

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34 github.com: https://github.com/libevent/libevent/commit/825c18bd99f556b59d61200523237f264d5cc734 github.com: https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha