CVE-2026-63383
Libevent: decode_tag_internal() can lead to out-of-bounds read
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
| CWE | CWE-125 |
| Vendor | libevent |
| Product | libevent |
| Published | Aug 20, 2026 |
| Last Updated | Aug 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for libevent libevent
Be the first to know when new unknown vulnerabilities affecting libevent libevent are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
libevent / libevent
>= 2.2.0-alpha, < 2.2.2-alpha < 2.1.13
References
github.com: https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6 github.com: https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321 github.com: https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb github.com: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable github.com: https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha