Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libevent-docUpgrade libevent-develUpgrade libevent | Oct 11, 2026 | Sep 16, 2026 |
| Debian | — | Upgrade libevent | Sep 21, 2026 | Aug 20, 2026 |
| Redhat_linux | — | No solution existsUpgrade libeventUpgrade libevent-debuginfoUpgrade libevent-docUpgrade libevent-debugsourceUpgrade libevent-devel | Aug 31, 2026 | Aug 20, 2026 |
| Rocky_linux | — | Upgrade libevent-develUpgrade libevent-debuginfoUpgrade libeventUpgrade libevent-debugsource | Sep 18, 2026 | Sep 17, 2026 |
| Ubuntu | — | Upgrade libevent-openssl-2.0-5 (Ubuntu Pro)Upgrade libevent-2.1-6 (Ubuntu Pro)Upgrade libevent-core-2.1-6 (Ubuntu Pro)Upgrade libevent-extra-2.0-5 (Ubuntu Pro)Upgrade libevent-openssl-2.1-6 (Ubuntu Pro)Upgrade libevent-extra-2.1-7t64Upgrade libevent-pthreads-2.1-7t64Upgrade libevent-core-2.1-7 (Ubuntu Pro)Upgrade libevent-pthreads-2.1-7Upgrade libevent-openssl-2.1-7 (Ubuntu Pro)Upgrade libevent-core-2.1-7Upgrade libevent-extra-2.1-6 (Ubuntu Pro)Upgrade libevent-pthreads-2.0-5 (Ubuntu Pro)Upgrade libevent-openssl-2.1-7t64Upgrade libevent-extra-2.1-7 (Ubuntu Pro)Upgrade libevent-extra-2.1-7Upgrade libevent-dev (Ubuntu Pro)Upgrade libevent-2.1-7Upgrade libevent-2.1-7t64Upgrade libevent-core-2.1-7t64Upgrade libevent-core-2.0-5 (Ubuntu Pro)Upgrade libevent-devUpgrade libevent-pthreads-2.1-7 (Ubuntu Pro)Upgrade libevent-2.1-7 (Ubuntu Pro)Upgrade libevent-openssl-2.1-7Upgrade libevent-pthreads-2.1-6 (Ubuntu Pro)Upgrade libevent-2.0-5 (Ubuntu Pro) | Oct 6, 2026 | Sep 28, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub