GCVE-1988-2026-0383

Vulnerability from gna-1988 – Published: 2026-10-02 04:57 – Updated: 2026-10-02 04:57
VLAI
Title
[Bugtraq] [SECURITY] [DSA 6493-1] libevent security update
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6493-1 security@debian.org https://www.debian.org/security/ Aron Xu September 11, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libevent CVE ID : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383 CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388 Several vulnerabilities were discovered in libevent, an asynchronous event notification library. The HTTP implementation (evhttp) handled Transfer-Encoding and Content-Length headers, chunked-encoding line terminators, header line folding and chunked trailers too permissively, which could allow HTTP request smuggling, header injection or access control bypass when a libevent-based server or client is combined with an HTTP proxy. Out-of-bounds memory accesses in the DNS (evdns), tagged RPC (evtag/evrpc) and buffered socket (bufferevent) code, and a use-after-free in evbuffer, could result in denial of service or potentially the execution of arbitrary code when processing untrusted input. For the stable distribution (trixie), these problems have been fixed in version 2.1.13-stable-1~deb13u1. We recommend that you upgrade your libevent packages. For the detailed security status of libevent please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libevent Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqjpDsACgkQ+GQ1dHE8 m66UlwgAgrC5PETAeCcPs0IWznLVphNNUlMHpLO1mxWas+PVMSdyu6cN7iddjSc9 dfwwlb2Oy+kaa8h0EjLmQP4pywP/8115uzFdQ4b0/xUsPzJTgQrPT8ivp55kYLso JrHqcIGTOqenaFRJL81XdZrgw/dqnnYBkDBc1nzTfdDuNPaDZ63uw1e1YhEwdtqg Bcmn3Rvkvn32ehpEOO5GZIHvjr87agMtLrlhlUVDd+FmNqP5dI0D0uMZIPEMmr/V oy7hppI93rnNG4iEU/zFVoFK5pwwgo085TraLuPWVUsZ5t4uYMYVDSalFiCsvKaI LJsdek7rIHT7j2nlMwNwlJzVgepB8g== =S+60 -----END PGP SIGNATURE-----
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
unknown libevent security update Affected: unknown
guessed Create a notification for this product.
Credits
Aron Xu
Relationships
reference GCVE-1988-2026-0383 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "libevent security update",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Aron Xu"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-6493-1                   security@debian.org\nhttps://www.debian.org/security/                                  Aron Xu\nSeptember 11, 2026                    https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\nPackage        : libevent\nCVE ID         : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383\nCVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388\nSeveral vulnerabilities were discovered in libevent, an asynchronous event\nnotification library.\nThe HTTP implementation (evhttp) handled Transfer-Encoding and\nContent-Length headers, chunked-encoding line terminators, header line\nfolding and chunked trailers too permissively, which could allow HTTP\nrequest smuggling, header injection or access control bypass when a\nlibevent-based server or client is combined with an HTTP proxy.\nOut-of-bounds memory accesses in the DNS (evdns), tagged RPC\n(evtag/evrpc) and buffered socket (bufferevent) code, and a\nuse-after-free in evbuffer, could result in denial of service or\npotentially the execution of arbitrary code when processing untrusted\ninput.\nFor the stable distribution (trixie), these problems have been fixed in\nversion 2.1.13-stable-1~deb13u1.\nWe recommend that you upgrade your libevent packages.\nFor the detailed security status of libevent please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/libevent\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\niQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqjpDsACgkQ+GQ1dHE8\nm66UlwgAgrC5PETAeCcPs0IWznLVphNNUlMHpLO1mxWas+PVMSdyu6cN7iddjSc9\ndfwwlb2Oy+kaa8h0EjLmQP4pywP/8115uzFdQ4b0/xUsPzJTgQrPT8ivp55kYLso\nJrHqcIGTOqenaFRJL81XdZrgw/dqnnYBkDBc1nzTfdDuNPaDZ63uw1e1YhEwdtqg\nBcmn3Rvkvn32ehpEOO5GZIHvjr87agMtLrlhlUVDd+FmNqP5dI0D0uMZIPEMmr/V\noy7hppI93rnNG4iEU/zFVoFK5pwwgo085TraLuPWVUsZ5t4uYMYVDSalFiCsvKaI\nLJsdek7rIHT7j2nlMwNwlJzVgepB8g==\n=S+60\n-----END PGP SIGNATURE-----"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:24Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/item/8737c3999f8a964d5de05d33cd726d3be47dff5c69758623ccfc5c81df4b7360"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/KOKQZ3SY56BZ4QDICBLX5MBVSDEDOZZ4/"
        },
        {
          "url": "https://security-tracker.debian.org/tracker/libevent"
        },
        {
          "url": "https://www.debian.org/security/"
        },
        {
          "url": "https://www.debian.org/security/faq"
        }
      ],
      "source": {
        "defect": [
          "E1x4vIc-0000000DNFW-2gNP%40seger.debian.org"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[Bugtraq] [SECURITY] [DSA 6493-1] libevent security update",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-63379",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63381",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63382",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63383",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63384",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63385",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63387",
              "type": "related"
            },
            {
              "destId": "CVE-2026-63388",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0383",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/item/8737c3999f8a964d5de05d33cd726d3be47dff5c69758623ccfc5c81df4b7360",
            "automated": true,
            "contentSha256": "8737c3999f8a964d5de05d33cd726d3be47dff5c69758623ccfc5c81df4b7360",
            "evidenceScore": 7,
            "messageId": "E1x4vIc-0000000DNFW-2gNP%40seger.debian.org",
            "originalUrl": "https://lists.securityfocus.com/hyperkitty/list/bugtraq@securityfocus.com/message/KOKQZ3SY56BZ4QDICBLX5MBVSDEDOZZ4/",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-02T04:57:24Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0383"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:24Z",
    "dateUpdated": "2026-10-02T04:57:24Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0383"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.