CVE-2026-63387
Published: August 22, 2026Last modified: September 1, 2026
Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7 |
| Attack Vector | NETWORK |
| Attack complexity | HIGH |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality | LOW |
| Integrity impact | LOW |
| Availability impact | HIGH |
| Vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H |
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | libevent | Fixed (2.1.13-r0) |
| 25 LTS | libevent | Fixed (2.1.13-r0) | |
| Stream | libevent | Fixed (2.1.13-r0) | |
| Hardened Containers | 23 LTS | libevent | Fixed (2.1.13-r0) |
| 25 LTS | libevent | Fixed (2.1.13-r0) | |
| Stream | libevent | Fixed (2.1.13-r0) |