CVE-2026-63380

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.

CVSS 4.0

5.7CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS

0.1% chance of exploitation in the next 30 days; higher than 3% of CVEs (scores of 2026-10-25)

CWEs

CWE-416, CWE-476

Published

2026-08-20

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

References

• https://github.com/libevent/libevent/commit/825c18bd99f556b59d61200523237f264d5cc734
• https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
• https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34
• https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34

Check your stackJSON