CVE Feed

    Dashboard / CVE / CVE-2026-63381

    CVE-2026-63381

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

    Published:Aug 20, 2026
    Last Modified:Aug 21, 2026
    EPS:Aug 20, 2026
    EPSS Score:0.00121
    CVSS Score:6.6

    Affected Products

    Vendor
    Libevent Project
    Product
    Libevent

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-63385 (CVSS 9.2) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weak…
    CVE-2026-63379 (CVSS 6.3) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP tr…
    CVE-2026-63387 (CVSS 7) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack b…
    CVE-2026-63384 (CVSS 8.7) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer …
    CVE-2026-63380 (CVSS 5.7) — Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointer…
    CVE-2026-63382 (CVSS 9.2) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http…
    CVE-2026-63495 (CVSS 7.5) — Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket serv…
    CVE-2026-63383 (CVSS 8.7) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contigu…
    CVE-2026-63388 (CVSS 8.4) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds …
    CVE-2016-10197 (CVSS 7.5) — The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of se…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High