What’s Vulnerable › Vulnerabilities

CVE-2026-63380: Libevent: Null Pointer Dereference in `evws_new_session`

• Severity: medium (CVSS 5.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-20 · updated 2026-10-26
• Weakness: CWE-416

Description

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.

Affected products

• libevent: before 2.2.2-alpha

References

• https://github.com/libevent/libevent/commit/825c18bd99f556b59d61200523237f264d5cc734
• https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
• https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34
• https://github.com/libevent/libevent/security/advisories/GHSA-3rpf-frgx-xq34

Get alerted when CVE-2026-63380 or the next vulnerability affects your stack