------------------------------------------------------------------------- Debian LTS Advisory DLA-4786-1 [email protected] https://www.debian.org/lts/security/ Andreans Henriksson September 18, 2026 https://wiki.debian.org/LTS -------------------------------------------------------------------------
Package : libevent
Version : 2.1.12-stable-8+deb12u1
CVE ID : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383
CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388
Debian Bug :
Multiple vulnerabilities has been found in libevent, an event notification
library.
CVE-2026-63379 (GHSA-2gmv-p5m7-98p6)
Sebastianosrt discovered that libevent's HTTP implementation did not
properly handle HTTP trailers. This could allow trailer headers to be
interpreted as regular request headers, potentially resulting in HTTP
header smuggling and request interpretation differences.
CVE-2026-63381 (GHSA-c2pj-cg4r-88c8)
DarkaMaul discovered a dangling pointer in
evbuffer_add_buffer_reference(). When the output buffer contained an empty
chain, the chain could be freed without updating the corresponding buffer
pointers before it was subsequently reused. This could result in memory
corruption or a denial of service.
CVE-2026-63382 (GHSA-q39v-w2g7-gr8j)
Xclow3n discovered that libevent's HTTP parser incorrectly handled
Transfer-Encoding headers and chunked request framing. The issue could
cause libevent and an HTTP proxy to disagree about request boundaries,
allowing HTTP request smuggling.
CVE-2026-63383 (GHSA-fj29-64w6-73h6)
Brubbish discovered an out-of-bounds read in the tagged RPC parsing code.
Processing a malformed RPC tag could cause libevent to read beyond the
available buffer, potentially resulting in a denial of service.
CVE-2026-63384 (GHSA-45c6-qx49-89m8)
Brubbish discovered an integer overflow in evtag_unmarshal_header().
An attacker able to supply a specially crafted tagged RPC message could
cause an incorrect length calculation, potentially resulting in memory
allocation or parsing errors and a denial of service.
CVE-2026-63385 (GHSA-jcwh-pvf2-73p2)
AsafMeizner discovered HTTP parsing issues involving percent-encoded NUL
bytes and obsolete folded headers. These parsing differences could allow a
frontend HTTP proxy and a libevent-based backend to interpret a request
differently, potentially resulting in access control bypass or header
injection.
CVE-2026-63387 (GHSA-58rx-7448-jw47)
Sectroyer discovered an off-by-one stack buffer overflow in the DNS server
code. A specially crafted DNS response could trigger an out-of-bounds
write when constructing a DNS response of a particular size, potentially
resulting in a denial of service or memory corruption.
CVE-2026-63388 (GHSA-cvq5-vrvr-j338)
Mat-mo discovered a heap-based out-of-bounds write in the socket handling
code. When accepting an AF_UNIX connection, an attacker-controlled peer
address could be copied into a buffer that was too small when assertions
were disabled. This could result in memory corruption and potentially
arbitrary code execution.
For Debian 12 bookworm, these problems have been fixed in version
2.1.12-stable-8+deb12u1.
We recommend that you upgrade your libevent packages.
For the detailed security status of libevent please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libevent
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
signature.asc
Description: PGP signature
