Executive brief
Libevent is an event notification library used by many networked applications to handle asynchronous event processing. A flaw in the WebSocket session creation code can cause the library to crash when memory allocation or locking operations fail, potentially disrupting services that depend on it. A local attacker able to trigger these specific failure conditions could cause a denial of service.
Technical details
The vulnerability is a null pointer dereference in the error path of the evws_new_session() function in ws.c. The root cause is a logic error where evws_connection_free() calls TAILQ_REMOVE on a websocket session that was never inserted into the http_server->ws_sessions list, because the failure occurred after evhttp_start_ws_() succeeded but before bufferevent_enable_locking_() completed. This causes the function to dereference invalid list pointers and trigger a segmentation fault. The attack requires local access and the ability to induce specific memory allocation or locking failures. The issue is fixed in version 2.2.2-alpha and later.
Affected products
- Libevent Libevent prior to 2.2.2-alpha
Timeline
- 2026-08-20: disclosed
- 2026-07-01: patched: Fixed in version 2.2.2-alpha