Executive brief
Libevent is a widely-used event notification library that handles asynchronous I/O operations across many applications. A flaw in its DNS response parser allows an attacker to send a crafted DNS response that triggers a one-byte stack buffer overflow, potentially crashing the application or corrupting process memory. This could affect any service or application that uses libevent to handle DNS queries.
Technical details
The vulnerability is an off-by-one stack buffer overflow in the evdns.c module, specifically in the dnsname_to_labels function when it formats DNS responses. The function allocates a 64 KB stack buffer via evdns_server_request_format_response and writes DNS record data (PTR, CNAME, MX, NS, or SOA records) into it. The boundary check permits writing a terminating null byte one position past the intended buffer limit, allowing a single-byte write past buf[buf_len]. An attacker can craft a malicious DNS server response containing one of the affected record types to trigger this overflow, resulting in process crash or memory corruption. The issue is fixed in libevent versions 2.1.13 and 2.2.2-alpha.
Affected products
- Libevent Libevent Prior to 2.1.13 and 2.2.2-alpha
Timeline
- 2026-08-20: disclosed
- 2026-07-01: patched: Fix released in versions 2.1.13-stable and 2.2.2-alpha