The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a     contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from     evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-     byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which     can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions     2.1.13 and 2.2.2-alpha. (CVE-2026-63383)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6493 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6493-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     September 11, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : libevent     CVE ID         : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383                      CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388

    Several vulnerabilities were discovered in libevent, an asynchronous event     notification library.

    The HTTP implementation (evhttp) handled Transfer-Encoding and     Content-Length headers, chunked-encoding line terminators, header line     folding and chunked trailers too permissively, which could allow HTTP     request smuggling, header injection or access control bypass when a     libevent-based server or client is combined with an HTTP proxy.

    Out-of-bounds memory accesses in the DNS (evdns), tagged RPC     (evtag/evrpc) and buffered socket (bufferevent) code, and a     use-after-free in evbuffer, could result in denial of service or     potentially the execution of arbitrary code when processing untrusted     input.

    For the stable distribution (trixie), these problems have been fixed in     version 2.1.13-stable-1~deb13u1.

    We recommend that you upgrade your libevent packages.

    For the detailed security status of libevent please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libevent

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0a83f1b852 advisory.

    # Update to 2.1.13.

    The following security vulnerabilites are fixed in this update:

    - GHSA-fj29-64w6-73h6 CVE-2026-63383 <https://github.com/libevent/libevent/security/advisories/GHSA-     fj29-64w6-73h6>
    - GHSA-45c6-qx49-89m8 CVE-2026-63384     <https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8>
    - GHSA-cvq5-vrvr-j338 CVE-2026-63388 <https://github.com/libevent/libevent/security/advisories/GHSA-     cvq5-vrvr-j338>
    - GHSA-58rx-7448-jw47 CVE-2026-63387     <https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47>
    - GHSA-2gmv-p5m7-98p6 CVE-2026-63379     <https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6>
    - GHSA-c2pj-cg4r-88c8 CVE-2026-63381 <https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-     cg4r-88c8>
    - GHSA-q39v-w2g7-gr8j CVE-2026-63382     <https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j>
    - GHSA-jcwh-pvf2-73p2 CVE-2026-63385 <https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-     pvf2-73p2>


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2128 advisory.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a     contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from     evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-     byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which     can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions     2.1.13 and 2.2.2-alpha. (CVE-2026-63383)

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect     integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an     attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become     negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing,     producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13     and 2.2.2-alpha. (CVE-2026-63384)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-72d10c874d advisory.

    # Update to 2.1.13.

    The following security vulnerabilites are fixed in this update:

    - GHSA-fj29-64w6-73h6 CVE-2026-63383 <https://github.com/libevent/libevent/security/advisories/GHSA-     fj29-64w6-73h6>
    - GHSA-45c6-qx49-89m8 CVE-2026-63384     <https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8>
    - GHSA-cvq5-vrvr-j338 CVE-2026-63388 <https://github.com/libevent/libevent/security/advisories/GHSA-     cvq5-vrvr-j338>
    - GHSA-58rx-7448-jw47 CVE-2026-63387     <https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47>
    - GHSA-2gmv-p5m7-98p6 CVE-2026-63379     <https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6>
    - GHSA-c2pj-cg4r-88c8 CVE-2026-63381 <https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-     cg4r-88c8>
    - GHSA-q39v-w2g7-gr8j CVE-2026-63382     <https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j>
    - GHSA-jcwh-pvf2-73p2 CVE-2026-63385 <https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-     pvf2-73p2>

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106194 advisory.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a     contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from     evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-     byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which     can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions     2.1.13 and 2.2.2-alpha.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-728dd9f704 advisory.

    # Update to 2.1.13.

    The following security vulnerabilites are fixed in this update:

    - GHSA-fj29-64w6-73h6 CVE-2026-63383 <https://github.com/libevent/libevent/security/advisories/GHSA-     fj29-64w6-73h6>
    - GHSA-45c6-qx49-89m8 CVE-2026-63384     <https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8>
    - GHSA-cvq5-vrvr-j338 CVE-2026-63388 <https://github.com/libevent/libevent/security/advisories/GHSA-     cvq5-vrvr-j338>
    - GHSA-58rx-7448-jw47 CVE-2026-63387     <https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47>
    - GHSA-2gmv-p5m7-98p6 CVE-2026-63379     <https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6>
    - GHSA-c2pj-cg4r-88c8 CVE-2026-63381 <https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-     cg4r-88c8>
    - GHSA-q39v-w2g7-gr8j CVE-2026-63382     <https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j>
    - GHSA-jcwh-pvf2-73p2 CVE-2026-63385 <https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-     pvf2-73p2>

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libevent installed on the remote host is prior to 2.0.21-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3902 advisory.

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a     contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from     evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-     byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which     can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions     2.1.13 and 2.2.2-alpha. (CVE-2026-63383)

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect     integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an     attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become     negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing,     producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13     and 2.2.2-alpha. (CVE-2026-63384)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
338636	Linux Distros Unpatched Vulnerability : CVE-2026-63383	Nessus	Misc.	8/21/2026	9/11/2026	high
344780	Debian dsa-6493 : libevent-2.1-7t64 - security update	Nessus	Debian Local Security Checks	9/11/2026	9/11/2026	critical
344983	Fedora 45 : libevent (2026-0a83f1b852)	Nessus	Fedora Local Security Checks	9/11/2026	9/11/2026	critical
345779	Amazon Linux 2023 : libevent, libevent-devel (ALAS2023-2026-2128)	Nessus	Amazon Linux Local Security Checks	9/14/2026	9/14/2026	high
343966	Fedora 44 : libevent (2026-72d10c874d)	Nessus	Fedora Local Security Checks	9/9/2026	9/9/2026	critical
342924	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libevent (UTSA-2026-106194)	Nessus	Unity Linux Local Security Checks	9/4/2026	9/4/2026	high
344676	Fedora 43 : libevent (2026-728dd9f704)	Nessus	Fedora Local Security Checks	9/11/2026	9/11/2026	critical
345780	Amazon Linux 2 : libevent (ALAS-2026-3902)	Nessus	Amazon Linux Local Security Checks	9/14/2026	9/14/2026	high

Detections

Analytics

Plugins Search

high

critical

critical

high

critical

high

critical

high