{"id":"CVE-2026-63384","summary":"Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.","details":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","aliases":["GHSA-45c6-qx49-89m8"],"modified":"2026-09-11T08:36:40.575001Z","published":"2026-08-20T17:53:08.417Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63384.json"},"references":[{"type":"WEB","url":"https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"},{"type":"WEB","url":"https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63384.json"},{"type":"ADVISORY","url":"https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63384"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda"},{"type":"FIX","url":"https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/libevent/libevent","events":[{"introduced":"0"},{"fixed":"df3ecad3a040fd6d4fad4287defe113395de6fd7"},{"fixed":"79ddfb460847999b807cba76d04e73891f29c6ee"},{"fixed":"109c16499282959d70f56ec3baf4c8b1e6646bda"},{"fixed":"5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"2.2.0-alpha"},{"fixed":"2.2.2-alpha"},{"introduced":"0"},{"fixed":"2.1.13"}]}}],"versions":["release-2.1.12-stable","release-2.2.1-alpha","release-2.1.11-stable","release-2.1.10-stable","release-2.1.9-beta","release-2.1.8-stable","release-2.1.7-rc","release-2.1.6-beta","release-2.1.5-beta","release-2.1.4-alpha","release-2.1.3-alpha","release-2.1.2-alpha","release-2.1.1-alpha","release-2.0.10-stable","release-2.0.9-rc","release-2.0.8-rc","release-2.0.7-rc","release-2.0.6-rc","release-2.0.5-beta","release-2.0.4-alpha","release-2.0.3-alpha","release-2.0.1-alpha","release-1.1b"],"database_specific":{"vanir_signatures":[{"id":"CVE-2026-63384-05d7cf03","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda","target":{"function":"evtag_unmarshal_header","file":"event_tagging.c"},"deprecated":false,"digest":{"function_hash":"65618021557916598666749967159040448195","length":250}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7","target":{"file":"test/regress_http.c","function":"http_check_transfer_encoding_test"},"deprecated":false,"digest":{"function_hash":"159443554126248192493229143747497657830","length":554},"id":"CVE-2026-63384-09212634"},{"target":{"file":"event_tagging.c","function":"evtag_unmarshal_header"},"deprecated":false,"digest":{"function_hash":"65618021557916598666749967159040448195","length":250},"id":"CVE-2026-63384-79cf092b","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda","target":{"file":"event_tagging.c"},"deprecated":false,"digest":{"line_hashes":["130688092411103881779793319185293442532","35591852254511256822037719077016828240","149333174035468761482274091843112180090","167782302790249760667996112209708432798"],"threshold":0.9},"id":"CVE-2026-63384-91b26bd8"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["270762094980121927552802584929566056086","37564212311334647331345684303177453724","168570413533780985513641597969239978857"]},"id":"CVE-2026-63384-923050c6","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/df3ecad3a040fd6d4fad4287defe113395de6fd7","target":{"file":"test/regress_http.c"}},{"source":"https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee","target":{"file":"test/regress_http.c"},"deprecated":false,"digest":{"line_hashes":["270762094980121927552802584929566056086","37564212311334647331345684303177453724","168570413533780985513641597969239978857"],"threshold":0.9},"id":"CVE-2026-63384-979e5bed","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["130688092411103881779793319185293442532","35591852254511256822037719077016828240","149333174035468761482274091843112180090","167782302790249760667996112209708432798"],"threshold":0.9},"id":"CVE-2026-63384-b9e1d770","signature_type":"Line","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416","target":{"file":"event_tagging.c"}},{"deprecated":false,"digest":{"function_hash":"159443554126248192493229143747497657830","length":554},"id":"CVE-2026-63384-ebc5ab94","signature_type":"Function","signature_version":"v1","source":"https://github.com/libevent/libevent/commit/79ddfb460847999b807cba76d04e73891f29c6ee","target":{"file":"test/regress_http.c","function":"http_check_transfer_encoding_test"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63384.json","vanir_signatures_modified":"2026-09-11T08:36:40Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}