Vulnerability Description
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.
Related Weaknesses (CWE)
References
- https://github.com/libevent/libevent/commit/825c18bd99f556b59d61200523237f264d5c
- https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
- https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34
FAQ
What is CVE-2026-63380?
CVE-2026-63380 is a documented vulnerability. Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but ...
How severe is CVE-2026-63380?
CVSS scoring is not yet available for CVE-2026-63380. Check NVD for updates.
Is there a patch for CVE-2026-63380?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.