CVE Feed

    Dashboard / CVE / CVE-2026-63380

    CVE-2026-63380

    Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.

    Published:Aug 20, 2026
    Last Modified:Aug 25, 2026
    EPS:Aug 20, 2026
    EPSS Score:0.00113
    CVSS Score:5.7

    Affected Products

    Vendor
    Libevent Project
    Product
    Libevent

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-63385 (CVSS 9.2) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weak…
    CVE-2026-63379 (CVSS 6.3) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP tr…
    CVE-2026-63387 (CVSS 7) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack b…
    CVE-2026-63384 (CVSS 8.7) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer …
    CVE-2026-63382 (CVSS 9.2) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http…
    CVE-2026-63381 (CVSS 5.8) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in b…
    CVE-2026-63495 (CVSS 7.5) — Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket serv…
    CVE-2026-63383 (CVSS 8.7) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contigu…
    CVE-2026-63388 (CVSS 8.4) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds …
    CVE-2016-10197 (CVSS 7.5) — The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of se…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High