Quick answers
- Is CVE-2026-63384 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-63384 being exploited in the wild.
- How severe is CVE-2026-63384?
- Informational severity, with a CVSS score of 7.5, published 20 August 2026.
- Which products and versions are affected?
- Libevent before 2.1.13 and before 2.2.2-alpha.
- Is there a fix for CVE-2026-63384?
- A patch was published on 2026-08-20: Patches available in versions 2.1.13 and 2.2.2-alpha Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-63384 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-63384?
- Check whether you run Libevent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an integer conversion flaw in event_tagging.c, specifically in the evtag_unmarshal_header function. When decoding an attacker-controlled uint32 payload length via evtag_decode_int, values exceeding INT_MAX are incorrectly converted to negative or truncated values when cast to a signed int. This malformed length is then passed to evtag_unmarshal_string for memory allocation sizing, causing a wrapped/oversized allocation request that results in denial of service. The fix rejects any payload length larger than INT_MAX. No authentication or special privileges are required; an attacker only needs network access to send a malicious RPC message to an application using vulnerable libevent versions (before 2.1.13 or 2.2.2-alpha).
Affected products
- Libevent Libevent before 2.1.13 and before 2.2.2-alpha
Timeline
- 2026-08-20: disclosed: CVE-2026-63384 published
- 2026-08-20: patched: Patches available in versions 2.1.13 and 2.2.2-alpha