Event Notification Library Vulnerability in Libevent

CVE-2026-63380

What is CVE-2026-63380?

Libevent, an event notification library, contains a memory dereference vulnerability in its websocket handling. When the function evws_new_session encounters an error after successfully starting a websocket connection, it may lead to dereferencing invalid pointers, causing a crash. The issue arises when bufferevent_enable_locking_ fails but the websocket session is handled unconditionally. This could allow a local attacker to exploit the situation, leading to potential process crashes. The vulnerability has been rectified in version 2.2.2-alpha.

References