{"id":"CVE-2026-63383","summary":"Libevent: decode_tag_internal() can lead to out-of-bounds read","details":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","aliases":["GHSA-fj29-64w6-73h6"],"modified":"2026-08-22T09:15:56.055151Z","published":"2026-08-20T17:48:24.568Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63383.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-125"]},"references":[{"type":"WEB","url":"https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"},{"type":"WEB","url":"https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63383.json"},{"type":"ADVISORY","url":"https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63383"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libevent/libevent","events":[{"introduced":"0"},{"fixed":"df3ecad3a040fd6d4fad4287defe113395de6fd7"},{"fixed":"79ddfb460847999b807cba76d04e73891f29c6ee"},{"fixed":"91ed8745eebabdd27592a83d350338a8c4626321"},{"fixed":"e1f9e21887c6b104e206a718385ba3ffc75180cb"}],"database_specific":{"extracted_events":[{"introduced":"2.2.0-alpha"},{"fixed":"2.2.2-alpha"},{"introduced":"0"},{"fixed":"2.1.13"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["release-2.1.12-stable","release-2.2.1-alpha","release-2.1.11-stable","release-2.1.10-stable","release-2.1.9-beta","release-2.1.8-stable","release-2.1.7-rc","release-2.1.6-beta","release-2.1.5-beta","release-2.1.4-alpha","release-2.1.3-alpha","release-2.1.2-alpha","release-2.1.1-alpha","release-2.0.10-stable","release-2.0.9-rc","release-2.0.8-rc","release-2.0.7-rc","release-2.0.6-rc","release-2.0.5-beta","release-2.0.4-alpha","release-2.0.3-alpha","release-2.0.1-alpha","release-1.1b"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63383.json","vanir_signatures_modified":"2026-08-22T09:15:56Z","vanir_signatures":[{"source":"https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7","target":{"file":"test/regress_http.c","function":"http_check_transfer_encoding_test"},"deprecated":false,"digest":{"length":554,"function_hash":"159443554126248192493229143747497657830"},"id":"CVE-2026-63383-09212634","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321","target":{"file":"event_tagging.c","function":"decode_tag_internal"},"deprecated":false,"digest":{"function_hash":"168865482628713793503789314971219105523","length":704},"id":"CVE-2026-63383-1e099809","signature_type":"Function"},{"target":{"file":"test/regress_http.c"},"deprecated":false,"digest":{"line_hashes":["270762094980121927552802584929566056086","37564212311334647331345684303177453724","168570413533780985513641597969239978857"],"threshold":0.9},"id":"CVE-2026-63383-923050c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321","target":{"file":"event_tagging.c"},"deprecated":false,"digest":{"line_hashes":["104338165365218942223873430718498962580","197559866763955992807133802376084695642","180222505040829602031624580772183847601","230938447835112626104817401062989772195","330094891237094194071080774629454319725","24728724588386346609432449053341075988","8463618082298884694292563523725245195","280746736387738957900849441955891038327"],"threshold":0.9},"id":"CVE-2026-63383-92598536"},{"signature_version":"v1","source":"https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee","target":{"file":"test/regress_http.c"},"deprecated":false,"digest":{"line_hashes":["270762094980121927552802584929566056086","37564212311334647331345684303177453724","168570413533780985513641597969239978857"],"threshold":0.9},"id":"CVE-2026-63383-979e5bed","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"168865482628713793503789314971219105523","length":704},"id":"CVE-2026-63383-bfebe374","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb","target":{"file":"event_tagging.c","function":"decode_tag_internal"}},{"target":{"function":"http_check_transfer_encoding_test","file":"test/regress_http.c"},"deprecated":false,"digest":{"function_hash":"159443554126248192493229143747497657830","length":554},"id":"CVE-2026-63383-ebc5ab94","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee"},{"target":{"file":"event_tagging.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["104338165365218942223873430718498962580","197559866763955992807133802376084695642","180222505040829602031624580772183847601","230938447835112626104817401062989772195","330094891237094194071080774629454319725","24728724588386346609432449053341075988","8463618082298884694292563523725245195","280746736387738957900849441955891038327"]},"id":"CVE-2026-63383-ecf93e73","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}