REDHAT-BUG-2520661: High severity libevent libevent vulnerability

Q: Which deployments are exposed to this issue?

Affected deployments use a vulnerable libevent version and expose an AF_UNIX listener through the evhttp accept path. The vulnerable condition is specifically associated with release builds compiled with NDEBUG, where the relevant length assertion is disabled.

Q: What access does an attacker need?

An attacker must be an unauthenticated local peer that can connect to the affected AF_UNIX listener. No remote network access condition is described.

Q: What is the impact of successful exploitation?

A connecting peer can trigger a heap out-of-bounds write that overwrites an adjacent dns_request pointer and other heap data. This can cause memory corruption affecting confidentiality, integrity, and availability.

Q: Which versions contain the fix?

The issue is fixed in libevent 2.1.13 and 2.2.2-alpha.

Published Aug 20, 2026

Updated

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in buffereventsock.c when buffereventsocketsetconnaddress copies a kernel-supplied AFUNIX peer address into buffereventprivate.connaddress. Release builds compiled with NDEBUG disable the EVUTILASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AFUNIX listener can overwrite the adjacent dnsrequest pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Affected Software

1 affected component

libevent libevent<2.1.13, <2.2.2-alpha

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade libevent to a version that resolves this vulnerability.
Fixed in 2.1.13
Upgrade
Upgrade libevent to a version that resolves this vulnerability.
Fixed in 2.2.2-alpha

Event History

Aug 20, 2026

Data Sourced

via Red Hat·06:05 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Affected deployments use a vulnerable libevent version and expose an AF_UNIX listener through the evhttp accept path. The vulnerable condition is specifically associated with release builds compiled with NDEBUG, where the relevant length assertion is disabled.

What access does an attacker need?

An attacker must be an unauthenticated local peer that can connect to the affected AF_UNIX listener. No remote network access condition is described.

What is the impact of successful exploitation?

A connecting peer can trigger a heap out-of-bounds write that overwrites an adjacent dns_request pointer and other heap data. This can cause memory corruption affecting confidentiality, integrity, and availability.

Which versions contain the fix?

The issue is fixed in libevent 2.1.13 and 2.2.2-alpha.

REDHAT-BUG-2520661: High severity libevent libevent vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What is the impact of successful exploitation?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

What is the impact of successful exploitation?

Which versions contain the fix?