Integer Conversion Issue in Libevent Library by Libevent
CVE-2026-63384
8.7HIGH
What is CVE-2026-63384?
The Libevent library, used widely for event notification, has a vulnerability that arises from an incorrect integer conversion in the event_tagging.c file. This flaw occurs when the evtag_unmarshal_header function decodes an attacker-controlled uint32 payload length, which can lead to negative or truncated values when interpreted as a signed int. Consequently, when evtag_unmarshal_string utilizes this value for allocation sizing, it can cause a wrapped large allocation request, potentially resulting in denial of service conditions. This vulnerability has been addressed in versions 2.1.13 and 2.2.2-alpha.
Affected Version(s)
libevent >= 2.2.0-alpha, < 2.2.2-alpha < 2.2.0-alpha, 2.2.2-alpha
libevent < 2.1.13 < 2.1.13