Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
CVSS Details
- CVSS 4.0 Base Score: 8.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libevent-develUpgrade libeventUpgrade libevent-doc | Oct 11, 2026 | Sep 16, 2026 |
| Amazon Linux Ami 2 | — | Upgrade libevent-develUpgrade libevent-debuginfoUpgrade libeventUpgrade libevent-doc | Oct 19, 2026 | Oct 19, 2026 |
| Amazon_linux_2023 | — | Upgrade libevent-develUpgrade libeventUpgrade libevent-debugsourceUpgrade libevent-docUpgrade libevent-debuginfo | Sep 30, 2026 | Aug 20, 2026 |
| Debian | — | Upgrade libevent | Sep 21, 2026 | Aug 20, 2026 |
| Ibm Aix | — | Apply the fix or workaround for ntp_tmux_advisory15 | Oct 21, 2026 | Oct 21, 2026 |
| Oracle_linux | — | Upgrade libeventUpgrade libevent-develUpgrade libevent-doc | Oct 22, 2026 | Aug 20, 2026 |
| Redhat_linux | — | Upgrade libevent-develUpgrade libevent-debugsourceUpgrade libevent-docUpgrade libeventUpgrade libevent-debuginfoNo solution exists | Aug 31, 2026 | Aug 20, 2026 |
| Rocky_linux | — | Upgrade libevent-debuginfoUpgrade libevent-develUpgrade libevent-debugsourceUpgrade libevent | Sep 18, 2026 | Sep 17, 2026 |
| Ubuntu | — | Upgrade libevent-extra-2.1-7 (Ubuntu Pro)Upgrade libevent-2.1-7 (Ubuntu Pro)Upgrade libevent-core-2.0-5 (Ubuntu Pro)Upgrade libevent-core-2.1-6 (Ubuntu Pro)Upgrade libevent-dev (Ubuntu Pro)Upgrade libevent-core-2.1-7t64Upgrade libevent-extra-2.1-7Upgrade libevent-2.1-7Upgrade libevent-2.0-5 (Ubuntu Pro)Upgrade libevent-2.1-7t64Upgrade libevent-devUpgrade libevent-core-2.1-7 (Ubuntu Pro)Upgrade libevent-extra-2.0-5 (Ubuntu Pro)Upgrade libevent-2.1-6 (Ubuntu Pro)Upgrade libevent-extra-2.1-7t64Upgrade libevent-core-2.1-7Upgrade libevent-extra-2.1-6 (Ubuntu Pro) | Sep 2, 2026 | Sep 1, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub