The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792536927 advisory.

  - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in     http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding     values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header,     evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize     valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than     EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy     that frames the same request differently, an unauthenticated remote attacker can desynchronize request     boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This     issue is fixed in versions 2.1.13 and 2.2.2-alpha. (CVE-2026-63382)

  - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a     contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from     evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-     byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which     can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions     2.1.13 and 2.2.2-alpha. (CVE-2026-63383)

  - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect     integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an     attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become     negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing,     producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13     and 2.2.2-alpha. (CVE-2026-63384)

  - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing     weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL     characters, which can cause downstream C string operations to truncate a path and bypass validation     performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding     in header values containing carriage return or line feed characters, allowing a proxy and libevent to     interpret headers differently and enabling header injection or access control bypass. The CRLF header     acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate     the URI NUL-truncation condition. (CVE-2026-63385)

  - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one     stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of     the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j     plus label_len plus one to equal buf_len, after which the terminating null byte is written to     buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the     one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and     2.2.2-alpha. (CVE-2026-63387)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

CentOS Linux 7 [TuxCare] Security Update: libevent / libevent-devel / libevent-doc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792536927)

critical Nessus Plugin ID 370884

Version 1.2