Off-by-One Stack Buffer Overflow in Libevent Affects Multiple DNS Record Types
CVE-2026-63387
7HIGH
What is CVE-2026-63387?
Libevent, an event notification library, is affected by an off-by-one stack buffer overflow vulnerability in the 'evdns.c' file. This issue arises when the 'dnsname_to_labels' function processes a name-bearing DNS record, potentially causing a crash or corruption. The vulnerability allows for a crafted DNS server response with record types such as PTR, CNAME, MX, NS, or SOA to trigger an out-of-bounds write. The flaw is present in versions prior to 2.1.13 and 2.2.2-alpha. Users are strongly advised to upgrade to secure versions to mitigate this risk.
Affected Version(s)
libevent >= 2.2.0-alpha, < 2.2.2-alpha < 2.2.0-alpha, 2.2.2-alpha
libevent < 2.1.13 < 2.1.13