Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    1 vulnerability found for libevent security update by unknown

    GCVE-1988-2026-0383

    Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
    VLAI
    Title
    [Bugtraq] [SECURITY] [DSA 6493-1] libevent security update
    Summary
    -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6493-1 security@debian.org https://www.debian.org/security/ Aron Xu September 11, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libevent CVE ID : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383 CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388 Several vulnerabilities were discovered in libevent, an asynchronous event notification library. The HTTP implementation (evhttp) handled Transfer-Encoding and Content-Length headers, chunked-encoding line terminators, header line folding and chunked trailers too permissively, which could allow HTTP request smuggling, header injection or access control bypass when a libevent-based server or client is combined with an HTTP proxy. Out-of-bounds memory accesses in the DNS (evdns), tagged RPC (evtag/evrpc) and buffered socket (bufferevent) code, and a use-after-free in evbuffer, could result in denial of service or potentially the execution of arbitrary code when processing untrusted input. For the stable distribution (trixie), these problems have been fixed in version 2.1.13-stable-1~deb13u1. We recommend that you upgrade your libevent packages. For the detailed security status of libevent please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libevent Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqjpDsACgkQ+GQ1dHE8 m66UlwgAgrC5PETAeCcPs0IWznLVphNNUlMHpLO1mxWas+PVMSdyu6cN7iddjSc9 dfwwlb2Oy+kaa8h0EjLmQP4pywP/8115uzFdQ4b0/xUsPzJTgQrPT8ivp55kYLso JrHqcIGTOqenaFRJL81XdZrgw/dqnnYBkDBc1nzTfdDuNPaDZ63uw1e1YhEwdtqg Bcmn3Rvkvn32ehpEOO5GZIHvjr87agMtLrlhlUVDd+FmNqP5dI0D0uMZIPEMmr/V oy7hppI93rnNG4iEU/zFVoFK5pwwgo085TraLuPWVUsZ5t4uYMYVDSalFiCsvKaI LJsdek7rIHT7j2nlMwNwlJzVgepB8g== =S+60 -----END PGP SIGNATURE-----
    Severity
    No CVSS data available.
    Assigner
    References
    Impacted products
    Credits
    Aron Xu
    Relationships
    reference GCVE-1988-2026-0383 (this record)
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "libevent security update",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aron Xu"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-6493-1                   security@debian.org\nhttps://www.debian.org/security/                                  Aron Xu\nSeptember 11, 2026                    https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\nPackage        : libevent\nCVE ID         : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383\nCVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388\nSeveral vulnerabilities were discovered in libevent, an asynchronous event\nnotification library.\nThe HTTP implementation (evhttp) handled Transfer-Encoding and\nContent-Length headers, chunked-encoding line terminators, header line\nfolding and chunked trailers too permissively, which could allow HTTP\nrequest smuggling, header injection or access control bypass when a\nlibevent-based server or client is combined with an HTTP proxy.\nOut-of-bounds memory accesses in the DNS (evdns), tagged RPC\n(evtag/evrpc) and buffered socket (bufferevent) code, and a\nuse-after-free in evbuffer, could result in denial of service or\npotentially the execution of arbitrary code when processing untrusted\ninput.\nFor the stable distribution (trixie), these problems have been fixed in\nversion 2.1.13-stable-1~deb13u1.\nWe recommend that you upgrade your libevent packages.\nFor the detailed security status of libevent please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/libevent\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\niQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqjpDsACgkQ+GQ1dHE8\nm66UlwgAgrC5PETAeCcPs0IWznLVphNNUlMHpLO1mxWas+PVMSdyu6cN7iddjSc9\ndfwwlb2Oy+kaa8h0EjLmQP4pywP/8115uzFdQ4b0/xUsPzJTgQrPT8ivp55kYLso\nJrHqcIGTOqenaFRJL81XdZrgw/dqnnYBkDBc1nzTfdDuNPaDZ63uw1e1YhEwdtqg\nBcmn3Rvkvn32ehpEOO5GZIHvjr87agMtLrlhlUVDd+FmNqP5dI0D0uMZIPEMmr/V\noy7hppI93rnNG4iEU/zFVoFK5pwwgo085TraLuPWVUsZ5t4uYMYVDSalFiCsvKaI\nLJsdek7rIHT7j2nlMwNwlJzVgepB8g==\n=S+60\n-----END PGP SIGNATURE-----"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:24Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/item/8737c3999f8a964d5de05d33cd726d3be47dff5c69758623ccfc5c81df4b7360"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/KOKQZ3SY56BZ4QDICBLX5MBVSDEDOZZ4/"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/libevent"
        },
        {
          "url": "https://www.debian.org/security/"
        },
        {
          "url": "https://www.debian.org/security/faq"
        }
      ],
      "source": {
        "defect": [
          "E1x4vIc-0000000DNFW-2gNP%40seger.debian.org"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[Bugtraq] [SECURITY] [DSA 6493-1] libevent security update",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-63379",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63381",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63382",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63383",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63384",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63385",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63387",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63388",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0383",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/item/8737c3999f8a964d5de05d33cd726d3be47dff5c69758623ccfc5c81df4b7360",
            "automated": true,
            "contentSha256": "8737c3999f8a964d5de05d33cd726d3be47dff5c69758623ccfc5c81df4b7360",
            "evidenceScore": 7,
            "messageId": "E1x4vIc-0000000DNFW-2gNP%40seger.debian.org",
            "originalUrl": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/KOKQZ3SY56BZ4QDICBLX5MBVSDEDOZZ4/",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-02T04:57:24Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0383"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:24Z",
    "dateUpdated": "2026-10-02T04:57:24Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0383"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}