Memory Exhaustion Vulnerability in Libevent WebSocket Server

CVE-2026-63495

What is CVE-2026-63495?

The Libevent WebSocket server is susceptible to a memory exhaustion vulnerability caused by an improper handling of fragmented WebSocket frames. Specifically, from versions 2.2.0-alpha-dev up to 2.2.2-alpha, the server accumulates fragmented frames without enforcing a strict message-size limitation. This allows unauthenticated remote clients to send numerous fragmented frames with the FIN bit set to 0, leading to uncontrolled growth in memory usage until the system runs out of memory. This issue has been addressed in version 2.2.2-alpha, which enforces proper limits on fragmented messages to mitigate the risk of memory exhaustion.

References