{"schemaVersion":3,"id":"USN-8710-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"libevent vulnerabilities\n\nAlexis Challande discovered that libevent incorrectly handled certain\nempty output buffers. An attacker could possibly use this issue to\ntrigger a use-after-free, resulting in a denial of service or arbitrary\ncode execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04\nLTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-63381)\n\nRajat Raghav discovered that libevent incorrectly handled certain HTTP\nrequests. An attacker could possibly use this issue to desynchronize\nHTTP request boundaries, resulting in HTTP request smuggling.\n(CVE-2026-63382)\n\nQiu Sihao discovered that libevent incorrectly handled certain malformed\ntagged RPC data. An attacker could possibly use this issue to trigger an\nout-of-bounds read, resulting in a denial of service. (CVE-2026-63383)\n\nQiu Sihao discovered that libevent incorrectly handled certain large\npayload lengths in tagged RPC data. An attacker could possibly use this\nissue to consume excessive system resources, resulting in a denial of\nservice. (CVE-2026-63384)\n\nAsaf Meizner discovered that libevent incorrectly handled certain HTTP\nURIs and header values. An attacker could possibly use this issue to\ncause HTTP messages to be interpreted inconsistently, resulting in\nsecurity restrictions being bypassed. (CVE-2026-63385)","dates":{"published":"2026-09-01T15:27:40.000Z","modified":"2026-09-02T02:41:27.937Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"libevent","name":"libevent","label":"libevent","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libevent","purlType":"deb","versions":[{"text":"< 2.0.21-stable-1ubuntu1.14.04.2+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.0.21-stable-2ubuntu0.16.04.1+esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.1.8-stable-4ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.1.11-stable-1ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.1.12-stable-1ubuntu0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.1.12-stable-9ubuntu2.1","noFixRecorded":false,"fixedIn":null},{"text":"< 2.1.12-stable-10ubuntu0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.21-stable-1ubuntu1.14.04.2+esm1 | < 2.0.21-stable-2ubuntu0.16.04.1+esm1 | < 2.1.8-stable-4ubuntu0.1~esm1 | < 2.1.11-stable-1ubuntu0.1~esm1 | < 2.1.12-stable-1ubuntu0.1 | < 2.1.12-stable-9ubuntu2.1 | < 2.1.12-stable-10ubuntu0.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8710-1","label":"ubuntu.com/security/notices/USN-8710-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63381","label":"ubuntu.com/security/CVE-2026-63381","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-63382","label":"ubuntu.com/security/CVE-2026-63382","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-63383","label":"ubuntu.com/security/CVE-2026-63383","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-63384","label":"ubuntu.com/security/CVE-2026-63384","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-63385","label":"ubuntu.com/security/CVE-2026-63385","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2026-63381","CVE-2026-63382","CVE-2026-63383","CVE-2026-63384","CVE-2026-63385"],"downstream":[],"duplicates":[],"related":["CVE-2026-63381","CVE-2026-63382","CVE-2026-63383","CVE-2026-63384","CVE-2026-63385"]},"timeline":[{"kind":"published","date":"2026-09-01T15:27:40.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-02T02:41:27.937Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T19:50:37.811Z","stale":false,"partial":false}}