CVE-2026-63384: Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX become negative or truncated, and evtagunmarshalstring can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.1.13 - Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.2.2-alpha
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Deployments using Libevent versions earlier than 2.1.13 or 2.2.2-alpha are affected when they process attacker-controlled event-tagging payloads through evtag_unmarshal_header() and evtag_unmarshal_string().
What does an attacker need to supply to trigger the issue?
An attacker needs to control a wire-format uint32 payload length. A value greater than INT_MAX can be converted to a negative or truncated signed int and lead to a wrapped large allocation request.
What is the remediation?
Upgrade Libevent to version 2.1.13 or 2.2.2-alpha, which contain the fix.