CVE-2026-63384 Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.
An attacker can cause a denial of service in applications using Libevent by triggering an integer overflow in header decoding that leads to invalid memory allocation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63384?
CVE-2026-63384 is a high-severity vulnerability in libevent, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Weakness: CWE-190
Which versions are affected by CVE-2026-63384?
How do I fix CVE-2026-63384?
Upgrade to a fixed version.
Is CVE-2026-63384 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63384 exists.
Sources
Also known as AZL-96906, AZL-96935, AZL-97524, AZL-97554, BELL-CVE-2026-63384, DEBIAN-CVE-2026-63384 and 4 more.