RHSA-2026:67909 - Security Advisory

Topic

An update for libevent is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

• libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)
• libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)
• libevent: Libevent: Memory corruption due to use-after-free (CVE-2026-63381)
• libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)
• libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)
• libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)
• libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)
• libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning (CVE-2026-63379)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 10 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64
• Red Hat Enterprise Linux for IBM z Systems 10 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x
• Red Hat Enterprise Linux for Power, little endian 10 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le
• Red Hat Enterprise Linux for ARM 64 10 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64
• Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64
• Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x
• Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le
• Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64
• Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64
• Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le
• Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x

Fixes

• BZ - 2520654 - CVE-2026-63383 libevent: Libevent: Denial of Service via malformed RPC data
• BZ - 2520655 - CVE-2026-63387 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption
• BZ - 2520657 - CVE-2026-63381 libevent: Libevent: Memory corruption due to use-after-free
• BZ - 2520658 - CVE-2026-63384 libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header`
• BZ - 2520661 - CVE-2026-63388 libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling
• BZ - 2520666 - CVE-2026-63385 libevent: Libevent: HTTP header handling bugs create risk of access control bypass.
• BZ - 2520667 - CVE-2026-63379 libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning

CVEs

• CVE-2026-63379
• CVE-2026-63381
• CVE-2026-63382
• CVE-2026-63383
• CVE-2026-63384
• CVE-2026-63385
• CVE-2026-63387
• CVE-2026-63388

References

• https://access.redhat.com/security/updates/classification/#important