Executive brief
Libevent is a widely-used networking library that provides WebSocket support for building real-time communication services. An unauthenticated remote attacker can exploit a flaw in the WebSocket server to exhaust server memory by sending many fragmented frames, causing the service to crash or become unresponsive. This affects systems using Libevent's WebSocket functionality, potentially disrupting dependent applications and services.
Technical details
The vulnerability exists in the WebSocket implementation (ws.c) in Libevent versions 2.2.0-alpha through 2.2.2-alpha, where fragmented WebSocket frames are accumulated in the evws->incomplete_frames buffer without enforcing a total message-size limit. Although individual frames are bounded by WS_MAX_RECV_FRAME_SZ, an unauthenticated remote client can send multiple fragmented frames with FIN=0 (indicating more fragments follow) below the per-frame limit, causing the evbuffer to grow unboundedly. An attacker can trigger memory exhaustion by repeatedly sending such fragmented frames until the process or host runs out of memory. The fix, available in version 2.2.2-alpha (released 01 July 2026), adds enforcement of a maximum total message size to prevent this accumulation.
Affected products
- Libevent Libevent 2.2.0-alpha-dev to 2.2.2-alpha (exclusive of fix)
Timeline
- 2026-08-20: disclosed: CVE-2026-63495 published
- 2026-07-01: patched: Fixed in Libevent 2.2.2-alpha release