Search: CVE-2026-63387

Libevent versions prior to 2.1.13 and 2.2.2-alpha contain an off-by-one stack buffer overflow in the evdns.c component. This occurs when the dnsname_to_labels function formats a DNS record name at the end of a 64 KB stack buffer, allowing a one-byte out-of-bounds write. Crafted DNS server responses with PTR, CNAME, MX, NS, or SOA records can trigger this overflow, potentially causing process crashes or memory corruption. The issue is fixed in libevent versions 2.1.13 and 2.2.2-alpha.