Quick answers
- Is CVE-2026-63495 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-63495 being exploited in the wild.
- How severe is CVE-2026-63495?
- High severity, with a CVSS score of 7.5, published 20 August 2026.
- Which products and versions are affected?
- Libevent 2.2.0-alpha-dev to 2.2.2-alpha (exclusive of fix).
- Is there a fix for CVE-2026-63495?
- A patch was published on 2026-07-01: Fixed in Libevent 2.2.2-alpha release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-63495 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-63495?
- Check whether you run Libevent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the WebSocket implementation (ws.c) in Libevent versions 2.2.0-alpha through 2.2.2-alpha, where fragmented WebSocket frames are accumulated in the evws->incomplete_frames buffer without enforcing a total message-size limit. Although individual frames are bounded by WS_MAX_RECV_FRAME_SZ, an unauthenticated remote client can send multiple fragmented frames with FIN=0 (indicating more fragments follow) below the per-frame limit, causing the evbuffer to grow unboundedly. An attacker can trigger memory exhaustion by repeatedly sending such fragmented frames until the process or host runs out of memory. The fix, available in version 2.2.2-alpha (released 01 July 2026), adds enforcement of a maximum total message size to prevent this accumulation.
Affected products
- Libevent Libevent 2.2.0-alpha-dev to 2.2.2-alpha (exclusive of fix)
Timeline
- 2026-08-20: disclosed: CVE-2026-63495 published
- 2026-07-01: patched: Fixed in Libevent 2.2.2-alpha release