CVE-2026-63380
5.7
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| libevent | libevent | < 2.2.2-alpha | affected |
Weaknesses
- CWE-416: CWE-416: Use After Free
- CWE-476: CWE-476: NULL Pointer Dereference
References
- https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34
- https://github.com/libevent/libevent/commit/825c18bd99f556b59d61200523237f264d5cc734
- https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.