Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in buffereventsock.c when buffereventsocketsetconnaddress copies a kernel-supplied AFUNIX peer address into buffereventprivate.connaddress. Release builds compiled with NDEBUG disable the EVUTILASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AFUNIX listener can overwrite the adjacent dnsrequest pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WSMAXRECVFRAMESZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsnametolabels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdnsserverrequestformatresponse. The final-label check permits j plus labellen plus one to equal buflen, after which the terminating null byte is written to buf[buflen]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-10195, CVE-2016-10196, CVE-2016-10197. Reason: This candidate is a duplicate of CVE-2016-10195, CVE-2016-10196, and CVE-2016-10197. Notes: All CVE users should reference CVE-2016-10195, CVE-2016-10196, and/or CVE-2016-10197 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.

Three vulnerabilities in the <code>libevent</code> library allowing for out-of-bounds reads and denial of service (DoS) attacks.

A vulnerability was found in libevent. There is a stack-buffer overflow in evutil.c.

Upstream bug:

https://github.com/libevent/libevent/issues/318

Upstream patch:

https://github.com/libevent/libevent/commit/329acc18a0768c21ba22522f01a5c7f46cacc4d5

A vulnerability was found in libevent. The nameparse() function in libevent's DNS code is vulnerable to a buffer overread.

Upstream bug:

https://github.com/libevent/libevent/issues/317

Upstream patch:

https://github.com/libevent/libevent/commit/96f64a022014a208105ead6c8a7066018449d86d

A vulnerability was found in libevent. There is an out-of-bounds read in the DNS code of Libevent.

Upstream bug:

https://github.com/libevent/libevent/issues/332

Upstream patch:

https://github.com/libevent/libevent/commit/ec65c42052d95d2c23d1d837136d1cf1d9ecef9e

[None of the GHSA's list CVE id's at this time. -alan-]

-------- Forwarded Message -------- Subject: libevent 2.1.13-stable Date: Wed, 1 Jul 2026 05:31:52 -0700 From: Kevin Bowling <kevin.bowling () kev009 com> To: distributions () lists linux dev

https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable (and https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha) are primarily security releases and a re-priming the release process.

Changes in version 2.1.13-stable (01 July 2026)

This release contains several security fixes, affecting users of the following modules: evbuffer, bufferevent, evtag, evrpc, evdns, evhttp. If you have a program that uses one of those modules, or if you distribute libevent, you should upgrade.

Additionally, this release backports some small modernizations to the libevent codebase, to aid in compiling with the compilers released over the last few years.

Security Fixes (evtag, evrpc):

Fix an out-of-bounds read in decodetaginternal. (Found by @Brubbish. GHSA-fj29-64w6-73h6) Fix an integer overflow in evtagunmarshalheader. (Found by @Brubbish. GHSA-45c6-qx49-89m8)

Security Fixes (evhttp):

Discard HTTP trailers, to prevent header smuggling attacks. (Found by @sebastianosrt. GHSA-2gmv-p5m7-98p6) Restrict HTTP header parsing to prevent request smuggling. (Originally reported by @xclow3n; and then by @kodareef5, @nstaller0490, @AsafMeizneer, and @yaotushaozhu. GHSA-q39v-w2g7-gr8j.) Treat CRLF and %00 more strictly in HTTP headers, to prevent parser mismatch attacks. (Reported by @xclow3n and @AsafMeizner. See GHSA-q39v-w2g7-gr8j, GHSA-jcwh-pvf2-73p2.) Fix a heap out-of-bound write that could occur when using AFUNIX sockets and compiling libevent with -DNDEBUG. (Found by @mat-mo. GHSA-cvq5-vrvr-j338)

Security fixes (evbuffer, bufferevent):

Fixed a dangling pointer in evbufferaddreference. (Found by @DarkaMaul. GHSA-c2pj-cg4r-88c8)

Security fixes (evdns):

Fix an out-of-bounds write in dnsnametolabels when building a DNS response of 2^16 bytes. (Found by @sectroyer. GHSA-58rx-7448-jw47)

Security fixes (example code):

Avoid using strcpy() in sample/http-server.c. (Reported by @sectroyer. GHSA-5rgj-2c58-7jrc.)

Other fixes:

Backport fixes for numerous compiler warnings. Backport fixes for compilation with openssl 3 and later.

Regards, Kevin Bowling (co-maintainer)

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evwsnewsession enters its error path after evhttpstartws succeeds but buffereventenablelocking fails. evwsconnectionfree sees a non-null httpserver and unconditionally calls TAILQREMOVE even though the session was never inserted into httpserver->wssessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttpfindheader can select only the first header, evhttpchecktransferencoding was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttphandlechunkedread uses EVBUFFEREOLCRLF rather than EVBUFFEREOLCRLFSTRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in eventtagging.c when decodetaginternal requests at most five bytes from evbufferpullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in eventtagging.c when evtagunmarshalheader uses evtagdecodeint to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INTMAX become negative or truncated, and evtagunmarshalstring can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbufferaddbufferreference processes an output buffer whose outtotallen is zero. evbufferfreeallchains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->lastwithdatap, and APPENDCHAINMULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->inputheaders. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttpheaderisvalidvalue also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition.