Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

The libevent library contains several security flaws: CVE-2026-63382 involves HTTP parser bugs enabling HTTP request smuggling; CVE-2026-63383 is a denial of service via malformed RPC data; CVE-2026-63384 is a denial of service via integer conversion error in evtag_unmarshal_header; CVE-2026-63385 involves HTTP header handling bugs leading to access control bypass; CVE-2026-63387 is an off-by-one stack buffer overflow causing denial of service or data corruption; CVE-2026-63388 is an arbitrary code execution vulnerability via heap out-of-bounds write in AF_UNIX handling. These issues affect multiple stable versions of libevent in Red Hat Hardened Images and various Ubuntu LTS releases. Official patches have been released by Red Hat and Ubuntu, including updates distributed via Ubuntu Pro for legacy versions.

The vulnerabilities can lead to denial of service, HTTP request smuggling, access control bypass, data corruption, and arbitrary code execution. These impacts affect the confidentiality, integrity, and availability of systems using vulnerable libevent versions. The issues arise from improper handling of malformed RPC data, HTTP requests, HTTP headers, and AF_UNIX socket data. Exploitation could disrupt services or allow unauthorized actions depending on the specific flaw.

Official patches are available from Red Hat and Ubuntu. Users should apply the security updates to libevent packages as provided by their distribution. For Ubuntu, fixes are included in standard system updates and Ubuntu Pro for extended support on older LTS releases. Red Hat users should update to libevent version 2.1.13-0.1.hum1 or later as per the Red Hat advisory. No additional mitigation steps are required beyond applying these updates.