CVE-2026-63387: Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsnametolabels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdnsserverrequestformatresponse. The final-label check permits j plus labellen plus one to equal buflen, after which the terminating null byte is written to buf[buflen]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.1.13 - Upgrade
Upgrade
libeventto a version that resolves this vulnerability.Fixed in 2.2.2-alpha
Event History
Frequently Asked Questions
Which DNS record types can trigger the overflow?
A crafted DNS server response containing name-bearing PTR, CNAME, MX, NS, or SOA data can trigger the out-of-bounds write when the formatted name reaches the end of the 64 KB response buffer.
What does an attacker need to exploit this issue?
The attacker needs to supply a crafted DNS server response. No privileges or user interaction are required, but exploitation has high attack complexity.
Which versions contain the fix?
The issue is fixed in libevent 2.1.13 and 2.2.2-alpha. Versions prior to those releases are affected according to the available information.
What is the likely impact if the flaw is triggered?
The one-byte stack out-of-bounds write can crash the affected process or corrupt its memory. The reported impact includes low confidentiality and integrity impact and high availability impact.