CVE Feed

    Dashboard / CVE / CVE-2026-63495

    CVE-2026-63495

    Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.

    Published:Aug 20, 2026
    Last Modified:Aug 21, 2026
    EPS:Aug 20, 2026
    EPSS Score:0.00432
    CVSS Score:7.5

    Affected Products

    Vendor
    Libevent Project
    Product
    Libevent

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-63385 (CVSS 9.2) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weak…
    CVE-2026-63379 (CVSS 6.3) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP tr…
    CVE-2026-63387 (CVSS 7) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack b…
    CVE-2026-63384 (CVSS 8.7) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer …
    CVE-2026-63380 (CVSS 5.7) — Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointer…
    CVE-2026-63382 (CVSS 9.2) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http…
    CVE-2026-63381 (CVSS 5.8) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in b…
    CVE-2026-63383 (CVSS 8.7) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contigu…
    CVE-2026-63388 (CVSS 8.4) — Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds …
    CVE-2016-10197 (CVSS 7.5) — The search_make_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of se…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High