SB2026091117 - Debian update for libevent
Published: September 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 vulnerabilities.
1) Input validation error (CVE-ID: CVE-2026-63379)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to smuggle HTTP headers.
The vulnerability exists due to improper input validation in the evhttp_read_trailer function in http.c when processing HTTP trailer fields in chunked encoded requests. A remote attacker can send a specially crafted chunked HTTP request with malicious trailer headers to smuggle HTTP headers.
This can lead to request desynchronization, cache poisoning, access control bypass, or host header manipulation in deployments that trust or process the merged headers.
2) Expired pointer dereference (CVE-ID: CVE-2026-63381)
CWE-ID: CWE-825 - Expired pointer dereference
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to a dangling pointer in evbuffer_add_buffer_reference when handling a buffer state where out_total_len == 0. A remote attacker can trigger a specific sequence of buffer operations to disclose sensitive information.
The issue was found by fuzzing, and exploitation appears to require a specific sequence of buffer operations.
3) Input validation error (CVE-ID: CVE-2026-63382)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to smuggle HTTP requests and bypass access controls.
The vulnerability exists due to improper input validation in the evhttp HTTP parser when processing requests with multiple Transfer-Encoding headers. A remote attacker can send a specially crafted request with conflicting Transfer-Encoding headers to smuggle HTTP requests and bypass access controls.
Exploitation requires the service to be deployed behind an intermediary that interprets Transfer-Encoding differently and reuses the connection.
4) Out-of-bounds read (CVE-ID: CVE-2026-63383)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in decode_tag_internal() when parsing a malformed fragmented evbuffer tag. A remote attacker can send specially crafted input with more than 5 continuation bytes to cause a denial of service.
The issue is reachable through evtag_unmarshal_header(), and potential higher-level reachability exists via evrpc request parsing.
5) Integer overflow (CVE-ID: CVE-2026-63384)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer truncation in evtag_unmarshal_header() and evtag_unmarshal_string() when parsing crafted wire-encoded length fields. A remote attacker can send specially crafted input with a length value above INT_MAX to cause a denial of service.
The issue is triggered when a wire uint32 length is converted to a signed int, causing negative or truncated values that lead to an oversized wrapped allocation request in downstream string unmarshalling.
6) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-63385)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass access controls.
The vulnerability exists due to inconsistent interpretation of HTTP requests in evhttp_decode_uri_internal when processing percent-encoded URIs. A remote attacker can send a specially crafted request containing a %00 sequence to bypass access controls.
The issue arises because a decoded NUL byte can truncate the path for subsequent C string operations.
7) Stack-based buffer overflow (CVE-ID: CVE-2026-63387)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or corrupt adjacent stack state.
The vulnerability exists due to stack-based buffer overflow in dnsname_to_labels() in evdns.c when formatting DNS server responses containing name-bearing records. A remote attacker can send a specially crafted DNS query that causes the application to generate a crafted response to cause a denial of service or corrupt adjacent stack state.
The issue is triggered by an off-by-one condition when name encoding reaches the exact end of a 64 KB stack buffer before a terminating null byte is appended.
8) Out-of-bounds write (CVE-ID: CVE-2026-63388)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in bufferevent_socket_set_conn_address_ when processing AF_UNIX accept() results for peer socket addresses. A remote attacker can connect to a vulnerable Unix domain socket with a specially crafted abstract-namespace address to execute arbitrary code.
On builds with NDEBUG, the assertion guarding the copy is disabled. Exploitation requires access to connect to the application's AF_UNIX listener, and on pthread-enabled servers the overwrite can corrupt a lock pointer that is later dereferenced inside libc.
Remediation
Install update from vendor's website.