CVE-2026-63380: Libevent

Medium severity, CVSS 5.7. EPSS: 0.1% chance of exploitation in the next 30 days.

Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.

Affected products

• Libevent Libevent: before 2.2.2-alpha (fixed in 2.2.2-alpha)

Published 2026-08-20. Last modified 2026-09-09.