NULL pointer dereference in libevent - #VU136950

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to null pointer dereference in evws_connection_free when handling error paths during websocket session creation. A remote attacker can trigger a failure before the session is inserted into the ws_sessions list to cause a denial of service.

The issue occurs because http_server is set before session initialization is completed, and cleanup removes a list entry that was never inserted.

Affected software

Remediation

External References

• https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34
• https://github.com/libevent/libevent/blob/a994a52d5373d6284b27576efa617aff2baa7bd3/ws.c#L89

Related Security Bulletins

• Multiple vulnerabilities in libevent