Red Hat Security Advisory: libevent security update

The libevent library, which provides asynchronous event notification, contains several security flaws including denial of service via malformed RPC data (CVE-2026-63383), off-by-one stack buffer overflow (CVE-2026-63387), use-after-free memory corruption (CVE-2026-63381), integer conversion error causing denial of service (CVE-2026-63384), multiple HTTP parser bugs enabling request smuggling (CVE-2026-63382), arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388), HTTP header handling bugs risking access control bypass (CVE-2026-63385), and HTTP header smuggling allowing authorization bypass or cache poisoning (CVE-2026-63379). These vulnerabilities affect various stable versions of libevent used in Red Hat Hardened Images and related products.

The vulnerabilities can lead to denial of service, memory corruption, arbitrary code execution, request smuggling, authorization bypass, and cache poisoning. These impacts can compromise system stability, security controls, and potentially allow attackers to execute arbitrary code or bypass access restrictions.

Red Hat has released updated libevent packages (version 2.1.12-19.1.hum1) that address these vulnerabilities. Users of affected versions should apply these official updates promptly to mitigate the risks. No additional mitigation steps are indicated beyond applying the vendor-provided security update.