CVE-2026-63495

7.5 Élevée

Publiée le 20/08/2026 à 20:16 · Modifiée le 09/09/2026 à 23:19 · En attente d'analyse NVD · Source : security-advisories@github.com

Description

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.

Traduire en français

Produits concernés

libevent

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-400
CWE-770

Références

https://github.com/libevent/libevent/commit/291c4d1cd75695e898030ebd5c4ddf26c094077b
https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
https://github.com/libevent/libevent/security/advisories/GHSA-qx89-wf2v-vgmx
https://github.com/libevent/libevent/security/advisories/GHSA-qx89-wf2v-vgmx

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories