CVE-2026-63380: Libevent: Null Pointer Dereference in `evws_new_session`
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evwsnewsession enters its error path after evhttpstartws succeeds but buffereventenablelocking fails. evwsconnectionfree sees a non-null httpserver and unconditionally calls TAILQREMOVE even though the session was never inserted into httpserver->wssessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.2.2-alpha
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
A local caller that can cause an allocation failure or a locking failure during WebSocket session creation can trigger the crash. The impact described is process denial of service.
Are deployments on the default path affected?
The vulnerable path requires evhttp_start_ws_ to succeed and bufferevent_enable_locking_ to fail while evws_new_session is handling the resulting error. The provided information does not establish that this condition occurs in a default deployment.
What should be done if upgrading cannot happen immediately?
Restrict local access to components that can create WebSocket sessions and prevent untrusted local callers from inducing allocation or locking failures. The provided fix is version 2.2.2-alpha.
How can I determine whether an observed crash matches this issue?
Check whether the process crashes during WebSocket session creation after a locking failure, with cleanup reaching evws_connection_free. The failure is associated with removal from http_server->ws_sessions even though the session was never inserted into that list.