CVE-2026-63495: Libevent: Unbounded memory accumulation in WebSocket server via fragmented frames
Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WSMAXRECVFRAMESZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libevent WebSocket server (ws.c)to a version that resolves this vulnerability.Fixed in 2.2.2-alpha
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the libevent WebSocket server implementation in ws.c are affected if they run a version from 2.2.0-alpha-dev through 2.2.1-alpha. The issue is reachable by an unauthenticated remote client, so WebSocket endpoints accessible to untrusted clients are exposed.
What does an attacker need to do to trigger the denial of service?
An attacker can send repeated fragmented WebSocket frames with FIN=0 while keeping each frame below WS_MAX_RECV_FRAME_SZ. Libevent accumulates these fragments without a total message-size limit, eventually exhausting process or host memory.
Is there a fixed version?
Yes. The issue is fixed in libevent version 2.2.2-alpha.