SB2026070659 - Multiple vulnerabilities in libevent

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026070659

SB2026070659 - Multiple vulnerabilities in libevent

Published: July 6, 2026

Security Bulletin ID SB2026070659
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 80% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to execute arbitrary code.

The vulnerability exists due to stack-based buffer overflow in sample/http-server main() when processing a user-supplied Unix-domain socket path via the -U command-line argument. A local privileged user can supply an overly long socket path to execute arbitrary code.

Only builds and deployments that compile and use the sample/http-server example with Unix-domain socket support are affected.


2) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the WebSocket server fragmented-frame handling path in ws.c when processing fragmented WebSocket frames. A remote attacker can send a long sequence of valid fragmented frames with FIN=0 to cause a denial of service.

The issue affects applications using libevent's WebSocket server functionality, including code paths reached through evws_new_session and related APIs.


3) Compiler Removal of Code to Clear Buffers (CVE-ID: N/A)

CWE-ID: CWE-14 - Compiler Removal of Code to Clear Buffers

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to compiler removal of code to clear buffers in sha1.c when processing SHA1 input through the public API. A remote attacker can leverage a memory read primitive to disclose sensitive information.

Sensitive SHA1 input blocks, intermediate hash state, and counter data may remain on the stack after the affected functions return.


4) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in evws_connection_free when handling error paths during websocket session creation. A remote attacker can trigger a failure before the session is inserted into the ws_sessions list to cause a denial of service.

The issue occurs because http_server is set before session initialization is completed, and cleanup removes a list entry that was never inserted.


5) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in evws_new_session when handling error paths after evhttp_start_ws_ frees the request object. A remote attacker can trigger a subsequent call that uses the freed request object to cause a denial of service.

The advisory states that this condition was not found to be reachable because the null pointer dereference is hit first.


Remediation

Install update from vendor's website.

References