Is CVE-2026-63387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63387 being exploited in the wild.

How severe is CVE-2026-63387?

High severity, with a CVSS score of 7, published 20 August 2026.

Which products and versions are affected?

Libevent Prior to 2.1.13 and 2.2.2-alpha.

Is there a fix for CVE-2026-63387?

A patch was published on 2026-07-01: Fix released in versions 2.1.13-stable and 2.2.2-alpha Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63387 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63387?

Check whether you run Libevent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63387: Libevent off-by-one stack buffer overflow in DNS response parsing

CVE-2026-63387 · Severity: high · CVSS 7 · Published 2026-08-20

Libevent is a widely-used event notification library that handles asynchronous I/O operations across many applications. A flaw in its DNS response parser allows an attacker to send a crafted DNS response that triggers a one-byte stack buffer overflow, potentially crashing the application or corrupting process memory. This could affect any service or application that uses libevent to handle DNS queries.

Technologies: Libevent. Vendors: Libevent.

Quick answers

Is CVE-2026-63387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63387 being exploited in the wild.
How severe is CVE-2026-63387?: High severity, with a CVSS score of 7, published 20 August 2026.
Which products and versions are affected?: Libevent Prior to 2.1.13 and 2.2.2-alpha.
Is there a fix for CVE-2026-63387?: A patch was published on 2026-07-01: Fix released in versions 2.1.13-stable and 2.2.2-alpha Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63387 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63387?: Check whether you run Libevent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an off-by-one stack buffer overflow in the evdns.c module, specifically in the dnsname_to_labels function when it formats DNS responses. The function allocates a 64 KB stack buffer via evdns_server_request_format_response and writes DNS record data (PTR, CNAME, MX, NS, or SOA records) into it. The boundary check permits writing a terminating null byte one position past the intended buffer limit, allowing a single-byte write past buf[buf_len]. An attacker can craft a malicious DNS server response containing one of the affected record types to trigger this overflow, resulting in process crash or memory corruption. The issue is fixed in libevent versions 2.1.13 and 2.2.2-alpha.

Affected products

Libevent Libevent Prior to 2.1.13 and 2.2.2-alpha

Timeline

2026-08-20: disclosed
2026-07-01: patched: Fix released in versions 2.1.13-stable and 2.2.2-alpha

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.