CVE-2026-63495: Libevent

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.

Affected products

• Libevent Libevent: from 2.2.0-alpha-dev, before 2.2.2-alpha (fixed in 2.2.2-alpha)

Published 2026-08-20. Last modified 2026-09-09.