{"id":"AZL-97545","summary":"CVE-2026-63381 affecting package ntp 4.2.8p17-2","details":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf-\u003efirst, outbuf-\u003elast, or outbuf-\u003elast_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","modified":"2026-08-29T05:27:27Z","published":"2026-08-20T18:16:35Z","upstream":["CVE-2026-63381"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63381"}],"affected":[{"package":{"name":"ntp","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/ntp"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.2.8p17-2"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97545.json"}}],"schema_version":"1.9.0"}