Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0a83f1b852 advisory.

    # Update to 2.1.13.

    The following security vulnerabilites are fixed in this update:

    - GHSA-fj29-64w6-73h6 CVE-2026-63383 <https://github.com/libevent/libevent/security/advisories/GHSA-     fj29-64w6-73h6>
    - GHSA-45c6-qx49-89m8 CVE-2026-63384     <https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8>
    - GHSA-cvq5-vrvr-j338 CVE-2026-63388 <https://github.com/libevent/libevent/security/advisories/GHSA-     cvq5-vrvr-j338>
    - GHSA-58rx-7448-jw47 CVE-2026-63387     <https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47>
    - GHSA-2gmv-p5m7-98p6 CVE-2026-63379     <https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6>
    - GHSA-c2pj-cg4r-88c8 CVE-2026-63381 <https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-     cg4r-88c8>
    - GHSA-q39v-w2g7-gr8j CVE-2026-63382     <https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j>
    - GHSA-jcwh-pvf2-73p2 CVE-2026-63385 <https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-     pvf2-73p2>


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6493 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6493-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     September 11, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libevent     CVE ID         : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383                      CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388

    Several vulnerabilities were discovered in libevent, an asynchronous event     notification library.

    The HTTP implementation (evhttp) handled Transfer-Encoding and     Content-Length headers, chunked-encoding line terminators, header line     folding and chunked trailers too permissively, which could allow HTTP     request smuggling, header injection or access control bypass when a     libevent-based server or client is combined with an HTTP proxy.

    Out-of-bounds memory accesses in the DNS (evdns), tagged RPC     (evtag/evrpc) and buffered socket (bufferevent) code, and a     use-after-free in evbuffer, could result in denial of service or     potentially the execution of arbitrary code when processing untrusted     input.

    For the stable distribution (trixie), these problems have been fixed in     version 2.1.13-stable-1~deb13u1.

    We recommend that you upgrade your libevent packages.

    For the detailed security status of libevent please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libevent

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-728dd9f704 advisory.

    # Update to 2.1.13.

    The following security vulnerabilites are fixed in this update:

    - GHSA-fj29-64w6-73h6 CVE-2026-63383 <https://github.com/libevent/libevent/security/advisories/GHSA-     fj29-64w6-73h6>
    - GHSA-45c6-qx49-89m8 CVE-2026-63384     <https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8>
    - GHSA-cvq5-vrvr-j338 CVE-2026-63388 <https://github.com/libevent/libevent/security/advisories/GHSA-     cvq5-vrvr-j338>
    - GHSA-58rx-7448-jw47 CVE-2026-63387     <https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47>
    - GHSA-2gmv-p5m7-98p6 CVE-2026-63379     <https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6>
    - GHSA-c2pj-cg4r-88c8 CVE-2026-63381 <https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-     cg4r-88c8>
    - GHSA-q39v-w2g7-gr8j CVE-2026-63382     <https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j>
    - GHSA-jcwh-pvf2-73p2 CVE-2026-63385 <https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-     pvf2-73p2>

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-72d10c874d advisory.

    # Update to 2.1.13.

    The following security vulnerabilites are fixed in this update:

    - GHSA-fj29-64w6-73h6 CVE-2026-63383 <https://github.com/libevent/libevent/security/advisories/GHSA-     fj29-64w6-73h6>
    - GHSA-45c6-qx49-89m8 CVE-2026-63384     <https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8>
    - GHSA-cvq5-vrvr-j338 CVE-2026-63388 <https://github.com/libevent/libevent/security/advisories/GHSA-     cvq5-vrvr-j338>
    - GHSA-58rx-7448-jw47 CVE-2026-63387     <https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47>
    - GHSA-2gmv-p5m7-98p6 CVE-2026-63379     <https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6>
    - GHSA-c2pj-cg4r-88c8 CVE-2026-63381 <https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-     cg4r-88c8>
    - GHSA-q39v-w2g7-gr8j CVE-2026-63382     <https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j>
    - GHSA-jcwh-pvf2-73p2 CVE-2026-63385 <https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-     pvf2-73p2>

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106173 advisory.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-     bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied     AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable     the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into     the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the     adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and     availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0884 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-63388:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-     bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied     AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable     the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into     the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the     adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and     availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

    CVE-2026-63382:
    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in     http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding     values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header,     evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize     valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than     EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy     that frames the same request differently, an unauthenticated remote attacker can desynchronize request     boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This     issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-     bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied     AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable     the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into     the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the     adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and     availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha. (CVE-2026-63388)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
344983	Fedora 45 : libevent (2026-0a83f1b852)	Nessus	Fedora Local Security Checks	Local	critical
344780	Debian dsa-6493 : libevent-2.1-7t64 - security update	Nessus	Debian Local Security Checks	Local	critical
344676	Fedora 43 : libevent (2026-728dd9f704)	Nessus	Fedora Local Security Checks	Local	critical
343966	Fedora 44 : libevent (2026-72d10c874d)	Nessus	Fedora Local Security Checks	Local	critical
342908	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106173)	Nessus	Unity Linux Local Security Checks	Local	high
342219	TencentOS Server 4: libevent (TSSA-2026:0884)	Nessus	Tencent Local Security Checks	Local	critical
338700	Linux Distros Unpatched Vulnerability : CVE-2026-63388	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-63388

high

Tenable Plugins

critical

critical

critical

critical

high

critical

high