CVE-2026-63387

About vulnerability

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Affected product:

AlmaLinux 9.2 ESU , Alpine Linux 3.23 , Alpine Linux 3.24 , Amazon Linux 2 ELS , CentOS 6 ELS , CentOS 7 ELS , CloudLinux 7 ELS , Debian 11 ELS , Debian 12 , Debian 13 , Oracle Linux 6 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Ubuntu 18.04 ELS

Affected packages:

libevent @ 2.1.12 (+15 more)