Libevent: Prior to 2.1.13 and 2.2.2-a ...) (CVE-2026-63384)
Description
Multiple vulnerabilities were identified in libevent prior to versions 2.1.13 and 2.2.2-a, affecting various Ubuntu LTS releases. These include issues such as use-after-free, HTTP request smuggling, out-of-bounds read, denial of service, and security restriction bypass. The vulnerabilities impact Ubuntu 14.04 LTS through 26.04 LTS. Fixes are available through standard system updates or Ubuntu Pro for extended support versions.
CVSS v4.0
Affected software
pkg:deb/ubuntu/libevent?arch=source&distro=trustypkg:deb/ubuntu/libevent?arch=source&distro=xenialpkg:deb/ubuntu/libevent?arch=source&distro=bionicpkg:deb/ubuntu/libevent?arch=source&distro=focalpkg:deb/ubuntu/libevent?arch=source&distro=jammypkg:deb/ubuntu/libevent?arch=source&distro=noblepkg:deb/ubuntu/libevent?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Libevent, an event notification library, contains several security flaws in versions prior to 2.1.13 and 2.2.2-a. These include a use-after-free triggered by mishandling empty output buffers (CVE-2026-63381), HTTP request smuggling due to improper HTTP request handling (CVE-2026-63382), out-of-bounds read from malformed tagged RPC data (CVE-2026-63383), denial of service from large payload lengths in tagged RPC data (CVE-2026-63384), and security restriction bypass via inconsistent HTTP message interpretation (CVE-2026-63385). These issues affect multiple Ubuntu LTS versions from 14.04 through 26.04. The vendor advisory confirms patches are available and recommends updating to fixed package versions.
Potential Impact
An attacker could exploit these vulnerabilities to cause denial of service, execute arbitrary code, perform HTTP request smuggling, or bypass security restrictions. The impact varies per vulnerability but includes potential system compromise or service disruption. No known exploits in the wild have been reported. The affected Ubuntu LTS releases are widely used, increasing the importance of applying fixes.
Mitigation Recommendations
A fix is available. Users should apply the official patches provided by Ubuntu through standard system updates or via Ubuntu Pro for extended support releases. Updating libevent packages to the versions specified in the Ubuntu security notice USN-8710-1 will remediate these issues. No additional mitigation steps are required beyond applying these updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-63384
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:14.04:LTS","Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
Threat ID: 6a8c4c53acd9273b499be7d3
Added to database: 08/24/2026, 13:51:16 UTC
Last enriched: 09/10/2026, 21:33:36 UTC
Last updated: 10/08/2026, 06:48:18 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.