CVE-2026-63387
Received Received - Intake

Stack Buffer Overflow in Libevent DNS Response Handling

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63387
EUVD
EUVD-2026-63508

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
libevent libevent to 2.1.13 (exc)
libevent libevent to 2.2.2-alpha (exc)
libevent libevent 2.1.13
libevent libevent 2.2.2-alpha

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-193 A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63387 is an off-by-one stack buffer overflow in the libevent library affecting versions up to 2.1.12 and 2.2.1-alpha. The flaw occurs in the dnsname_to_labels() function in evdns.c when handling DNS server responses. A crafted response can trigger a one-byte out-of-bounds write, crashing or corrupting the process.

Detection Guidance

To detect this vulnerability, check the version of libevent installed on your system using commands like 'libevent_version' or 'dpkg -l libevent*' on Debian-based systems. Compare the version against the vulnerable ranges (up to 2.1.12 and 2.2.1-alpha). Monitor DNS server logs for crashes or corruption when handling DNS responses.

Impact Analysis

Exploitation may lead to process termination or corruption of adjacent stack memory. This could cause denial-of-service conditions or potentially allow arbitrary code execution depending on the environment and compiler settings.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling remote code execution or data corruption through crafted DNS responses. A successful exploit may lead to unauthorized access, data breaches, or service disruption, which are critical violations under these regulations. Organizations using vulnerable libevent versions must assess exposure and apply patches to maintain compliance.

Mitigation Strategies

Immediately upgrade libevent to version 2.1.13 or 2.2.2-alpha or later. If upgrading is not possible, disable DNS server functionality in libevent or restrict exposure to untrusted DNS traffic. Apply patches from the official libevent releases.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart