CVE-2026-63380
Received Received - Intake

Heap-based Buffer Overflow in Libevent

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63380
EUVD
EUVD-2026-63506

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
libevent libevent to 2.2.2-alpha (inc)
libevent libevent to 2.2.2-alpha (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a null pointer dereference in the libevent library's evws_new_session function. It occurs when an error path is triggered after a session is partially initialized but before it is properly added to a list. The cleanup function then tries to remove this uninitialized session from the list, causing a crash.

Detection Guidance

This vulnerability is specific to libevent versions prior to 2.2.2-alpha and requires code execution to trigger. Detection involves checking the installed libevent version and analyzing application logs for crashes related to websocket session handling.

Impact Analysis

This vulnerability can cause a denial-of-service condition by crashing the process. An attacker who can trigger the specific error conditions may cause the application using libevent to terminate unexpectedly.

Compliance Impact

This vulnerability causes a denial-of-service condition via a segmentation fault, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems. However, the vulnerability does not directly lead to data exposure or unauthorized access.

Mitigation Strategies
  • Upgrade libevent to version 2.2.2-alpha or later to address the null pointer dereference issue.
  • Review applications using libevent for websocket functionality and monitor for crashes in session handling.
  • Apply patches from the official libevent repository if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart