CVE-2026-63495
Received Received - Intake

Memory Exhaustion in Libevent WebSocket Server

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-63495
EUVD
EUVD-2026-63503

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
libevent libevent From 2.2.0-alpha-dev (inc) to 2.2.2-alpha (inc)
libevent libevent From 2.2.0-alpha-dev (inc) to 2.2.2-alpha (exc)
libevent libevent From 2.2.0-alpha-dev (inc) to 2.2.1-alpha-dev (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory exhaustion issue in the libevent library's WebSocket server component (evws). It allows unauthenticated remote attackers to send fragmented WebSocket frames without a total message size limit, causing the server to accumulate these fragments in memory until it exhausts available resources, leading to a denial-of-service condition.

Detection Guidance

Monitor memory usage of applications using libevent's WebSocket server. Check for processes with unusually high memory consumption or frequent crashes. Use tools like top, htop, or ps to observe memory usage patterns. Inspect network traffic for fragmented WebSocket frames with FIN=0 flags.

Impact Analysis

If you use an affected version of libevent, this vulnerability could allow attackers to crash your application or server by consuming all available memory. This disrupts service availability and may require restarting the affected system.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions, leading to potential violations of availability requirements in GDPR or HIPAA. Downtime due to DoS may result in non-compliance with uptime or data accessibility obligations.

Mitigation Strategies

Upgrade libevent to version 2.2.2-alpha or later. If upgrading is not possible, implement network-level protections to block or limit fragmented WebSocket traffic. Disable WebSocket functionality in affected applications if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart