Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.
This tracker was filed against CVE-2026-63380 based on an automated package-name match and does not actually apply to libevent (2.1.13-1) as shipped in Fedora. CVE-2026-63380 is a NULL pointer dereference in evws_new_session() (ws.c), part of libevent's WebSocket server module (evws). That module was only added upstream via commit e8313084 ("Add minimal WebSocket server implementation for evhttp") and has only ever shipped as part of the 2.2.x development/alpha line, culminating in the 2.2.2-alpha release that fixes this issue. It was never backported into the 2.1.x stable series. Closing this tracker as NOTABUG — vulnerable code not present in the shipped Fedora libevent package.