Executive brief
Libevent is a widely-used event notification library that powers many network applications. A flaw in its RPC tagging component allows an attacker to send a specially-crafted message that triggers incorrect memory allocation, leading to crashes or denial of service of applications using vulnerable versions of the library.
Technical details
The vulnerability is an integer conversion flaw in event_tagging.c, specifically in the evtag_unmarshal_header function. When decoding an attacker-controlled uint32 payload length via evtag_decode_int, values exceeding INT_MAX are incorrectly converted to negative or truncated values when cast to a signed int. This malformed length is then passed to evtag_unmarshal_string for memory allocation sizing, causing a wrapped/oversized allocation request that results in denial of service. The fix rejects any payload length larger than INT_MAX. No authentication or special privileges are required; an attacker only needs network access to send a malicious RPC message to an application using vulnerable libevent versions (before 2.1.13 or 2.2.2-alpha).
Affected products
- Libevent Libevent before 2.1.13 and before 2.2.2-alpha
Timeline
- 2026-08-20: disclosed: CVE-2026-63384 published
- 2026-08-20: patched: Patches available in versions 2.1.13 and 2.2.2-alpha