Libevent

7 CVEs in 1 Libevent product, including Libevent. Newest: CVE-2026-63495 (2026-08-20). Severity, EPSS and public exploits for each.

Libevent products with known CVEs

ProductCVEs
Libevent7
Libevent CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-63495High7.52026-08-20Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-…
CVE-2026-63388High8.42026-08-20Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_sock…
CVE-2026-63387High7.02026-08-20Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels…
CVE-2026-633852026-08-20Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal deco…
CVE-2026-633842026-08-20Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarsha…
CVE-2026-633822026-08-20Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Enco…
CVE-2026-633792026-08-20Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and…