# CVE-2026-63495: Libevent WebSocket unbounded memory accumulation via frame fragmentation

Source: https://junglewise.ai/threats/cve-2026-63495-libevent-websocket-unbounded-memory-accumulation-via-frame  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63495 · Severity: high · CVSS 7.5 · Published 2026-08-20

Libevent is a widely-used networking library that provides WebSocket support for building real-time communication services. An unauthenticated remote attacker can exploit a flaw in the WebSocket server to exhaust server memory by sending many fragmented frames, causing the service to crash or become unresponsive. This affects systems using Libevent's WebSocket functionality, potentially disrupting dependent applications and services.

Technologies: [Libevent](https://junglewise.ai/threats/technologies/libevent). Vendors: [Libevent](https://junglewise.ai/threats/vendors/libevent).

## Quick answers

**Is CVE-2026-63495 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63495 being exploited in the wild.

**How severe is CVE-2026-63495?** High severity, with a CVSS score of 7.5, published 20 August 2026.

**Which products and versions are affected?** Libevent 2.2.0-alpha-dev to 2.2.2-alpha (exclusive of fix).

**Is there a fix for CVE-2026-63495?** A patch was published on 2026-07-01: Fixed in Libevent 2.2.2-alpha release Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63495 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-63495?** Check whether you run Libevent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the WebSocket implementation (ws.c) in Libevent versions 2.2.0-alpha through 2.2.2-alpha, where fragmented WebSocket frames are accumulated in the evws->incomplete_frames buffer without enforcing a total message-size limit. Although individual frames are bounded by WS_MAX_RECV_FRAME_SZ, an unauthenticated remote client can send multiple fragmented frames with FIN=0 (indicating more fragments follow) below the per-frame limit, causing the evbuffer to grow unboundedly. An attacker can trigger memory exhaustion by repeatedly sending such fragmented frames until the process or host runs out of memory. The fix, available in version 2.2.2-alpha (released 01 July 2026), adds enforcement of a maximum total message size to prevent this accumulation.

## Affected products

- Libevent Libevent 2.2.0-alpha-dev to 2.2.2-alpha (exclusive of fix)

## Timeline

- 2026-08-20: disclosed: CVE-2026-63495 published
- 2026-07-01: patched: Fixed in Libevent 2.2.2-alpha release

## References

- [https://github.com/libevent/libevent/commit/291c4d1cd75695e898030ebd5c4ddf26c094077b](https://github.com/libevent/libevent/commit/291c4d1cd75695e898030ebd5c4ddf26c094077b)
- [https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha](https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha)

## Related threats

- [Libevent heap out-of-bounds write in bufferevent_sock](https://junglewise.ai/threats/cve-2026-63388-libevent-heap-out-of-bounds-write-in-bufferevent-sock)
- [Libevent off-by-one stack buffer overflow in DNS response parsing](https://junglewise.ai/threats/cve-2026-63387-libevent-off-by-one-stack-buffer-overflow-in-dns-response-parsing)
- [Libevent integer overflow in evtag_unmarshal_header](https://junglewise.ai/threats/cve-2026-63384-libevent-integer-overflow-in-evtag-unmarshal-header)
- [Libevent out-of-bounds read in event_tagging](https://junglewise.ai/threats/cve-2026-63383-libevent-out-of-bounds-read-in-event-tagging)
- [Libevent HTTP request smuggling via inconsistent Transfer-Encoding parsing](https://junglewise.ai/threats/cve-2026-63382-libevent-http-request-smuggling-via-inconsistent-transfer)