Bug 2535512

Summary:	CVE-2026-63380 libevent: Libevent: Denial of Service via Null Pointer Dereference [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Samuele Negrini <snegrini>
Component:	libevent	Assignee:	Steve Dickson <steved>
Status:	CLOSED NOTABUG	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	jorton, pzacik, steved
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["bc5e3f89-6863-4b30-be01-5f33eacca153"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-09-16 15:31:04 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2520656

Description Samuele Negrini 2026-09-16 15:21:27 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.

Comment 1 Samuele Negrini 2026-09-16 15:31:04 UTC

This tracker was filed against CVE-2026-63380 based on an automated package-name match and does not actually apply to libevent (2.1.13-1) as shipped in Fedora.
CVE-2026-63380 is a NULL pointer dereference in evws_new_session() (ws.c), part of libevent's WebSocket server module (evws). That module was only added upstream via commit e8313084 ("Add minimal WebSocket server implementation for evhttp") and has only ever shipped as part of the 2.2.x development/alpha line, culminating in the 2.2.2-alpha release that fixes this issue. It was never backported into the 2.1.x stable series.
Closing this tracker as NOTABUG — vulnerable code not present in the shipped Fedora libevent package.