Packages
- libevent - Event notification library
Details
Alexis Challande discovered that libevent incorrectly handled certain
empty output buffers. An attacker could possibly use this issue to
trigger a use-after-free, resulting in a denial of service or arbitrary
code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04
LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-63381)
Rajat Raghav discovered that libevent incorrectly handled certain HTTP
requests. An attacker could possibly use this issue to desynchronize
HTTP request boundaries, resulting in HTTP request smuggling.
(CVE-2026-63382)
Qiu Sihao discovered that libevent incorrectly handled certain malformed
tagged RPC data. An attacker could possibly use this issue to trigger an
out-of-bounds read, resulting in a denial of service. (CVE-2026-63383)
Qiu Sihao...
Alexis Challande discovered that libevent incorrectly handled certain
empty output buffers. An attacker could possibly use this issue to
trigger a use-after-free, resulting in a denial of service or arbitrary
code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04
LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-63381)
Rajat Raghav discovered that libevent incorrectly handled certain HTTP
requests. An attacker could possibly use this issue to desynchronize
HTTP request boundaries, resulting in HTTP request smuggling.
(CVE-2026-63382)
Qiu Sihao discovered that libevent incorrectly handled certain malformed
tagged RPC data. An attacker could possibly use this issue to trigger an
out-of-bounds read, resulting in a denial of service. (CVE-2026-63383)
Qiu Sihao discovered that libevent incorrectly handled certain large
payload lengths in tagged RPC data. An attacker could possibly use this
issue to consume excessive system resources, resulting in a denial of
service. (CVE-2026-63384)
Asaf Meizner discovered that libevent incorrectly handled certain HTTP
URIs and header values. An attacker could possibly use this issue to
cause HTTP messages to be interpreted inconsistently, resulting in
security restrictions being bypassed. (CVE-2026-63385)
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 26.04 LTS resolute | libevent-2.1-7t64 – 2.1.12-stable-10ubuntu0.1 | ||
| libevent-core-2.1-7t64 – 2.1.12-stable-10ubuntu0.1 | |||
| libevent-dev – 2.1.12-stable-10ubuntu0.1 | |||
| libevent-extra-2.1-7t64 – 2.1.12-stable-10ubuntu0.1 | |||
| 24.04 LTS noble | libevent-2.1-7t64 – 2.1.12-stable-9ubuntu2.1 | ||
| libevent-core-2.1-7t64 – 2.1.12-stable-9ubuntu2.1 | |||
| libevent-dev – 2.1.12-stable-9ubuntu2.1 | |||
| libevent-extra-2.1-7t64 – 2.1.12-stable-9ubuntu2.1 | |||
| 22.04 LTS jammy | libevent-2.1-7 – 2.1.12-stable-1ubuntu0.1 | ||
| libevent-core-2.1-7 – 2.1.12-stable-1ubuntu0.1 | |||
| libevent-dev – 2.1.12-stable-1ubuntu0.1 | |||
| libevent-extra-2.1-7 – 2.1.12-stable-1ubuntu0.1 | |||
| 20.04 LTS focal | libevent-2.1-7 – 2.1.11-stable-1ubuntu0.1~esm1 | ||
| libevent-core-2.1-7 – 2.1.11-stable-1ubuntu0.1~esm1 | |||
| libevent-dev – 2.1.11-stable-1ubuntu0.1~esm1 | |||
| libevent-extra-2.1-7 – 2.1.11-stable-1ubuntu0.1~esm1 | |||
| 18.04 LTS bionic | libevent-2.1-6 – 2.1.8-stable-4ubuntu0.1~esm1 | ||
| libevent-core-2.1-6 – 2.1.8-stable-4ubuntu0.1~esm1 | |||
| libevent-dev – 2.1.8-stable-4ubuntu0.1~esm1 | |||
| libevent-extra-2.1-6 – 2.1.8-stable-4ubuntu0.1~esm1 | |||
| 16.04 LTS xenial | libevent-2.0-5 – 2.0.21-stable-2ubuntu0.16.04.1+esm1 | ||
| libevent-core-2.0-5 – 2.0.21-stable-2ubuntu0.16.04.1+esm1 | |||
| libevent-dev – 2.0.21-stable-2ubuntu0.16.04.1+esm1 | |||
| libevent-extra-2.0-5 – 2.0.21-stable-2ubuntu0.16.04.1+esm1 | |||
| 14.04 LTS trusty | libevent-2.0-5 – 2.0.21-stable-1ubuntu1.14.04.2+esm1 | ||
| libevent-core-2.0-5 – 2.0.21-stable-1ubuntu1.14.04.2+esm1 | |||
| libevent-dev – 2.0.21-stable-1ubuntu1.14.04.2+esm1 | |||
| libevent-extra-2.0-5 – 2.0.21-stable-1ubuntu1.14.04.2+esm1 | |||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.