Libevent: Prior to 2.1.13 and 2.2.2-a ...) (CVE-2026-63381)

Libevent, an event notification library, contains multiple security flaws in versions prior to 2.1.13 and 2.2.2-a as used in various Ubuntu LTS releases. The primary vulnerability (CVE-2026-63381) involves incorrect handling of empty output buffers leading to a use-after-free condition, potentially allowing denial of service or arbitrary code execution. Additional vulnerabilities include HTTP request smuggling (CVE-2026-63382), out-of-bounds read from malformed tagged RPC data (CVE-2026-63383), denial of service from excessive resource consumption due to large RPC payloads (CVE-2026-63384), and security restriction bypass via inconsistent HTTP message interpretation (CVE-2026-63385). These issues were discovered by multiple researchers and affect Ubuntu 14.04 LTS through 26.04 LTS. Ubuntu has released patches for these vulnerabilities, and updates are available via standard system updates or Ubuntu Pro.

Successful exploitation of these vulnerabilities could allow an attacker with local privileges to cause denial of service or execute arbitrary code via use-after-free. HTTP request smuggling could desynchronize HTTP request boundaries, potentially impacting HTTP-based services. Out-of-bounds reads and excessive resource consumption could lead to denial of service. Bypassing HTTP message interpretation could allow security restrictions to be circumvented. The vulnerabilities affect multiple Ubuntu LTS releases, potentially impacting systems running vulnerable libevent versions.

A fix is available. Users should apply the official Ubuntu security updates for libevent as provided in the Ubuntu Security Notice USN-8710-1. For Ubuntu 14.04 through 26.04 LTS, standard system updates will install patched versions. Ubuntu Pro customers have access to fixes via Ubuntu Pro and Legacy Support add-ons. No additional mitigation steps are required beyond applying these updates.