CVE-2026-63380 in Libevent
Summary
by MITRE • 08/20/2026
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in libevent prior to version 2.2.2-alpha represents a critical memory management flaw within its WebSocket implementation, specifically located in the ws.c source file. Libevent serves as a widely adopted event notification library used by numerous high-performance network applications and servers. The core of this issue lies in the initialization sequence for WebSocket sessions, particularly when invoking evws_new_session. During this process, if the initial HTTP upgrade request via evhttp_start_ws_ succeeds but the subsequent attempt to enable locking on the underlying bufferevent fails, the code enters an error handling path that contains a logical defect leading to invalid pointer dereference and potential application crashes.
The technical root cause stems from improper state tracking during resource cleanup. When evws_new_session encounters the failure of bufferevent_enable_locking_, it proceeds to free resources associated with the partially constructed session object. The function evws_connection_free is invoked as part of this teardown process. This function checks if a non-null http_server pointer exists and, finding one present, unconditionally executes TAILQ_REMOVE on the ws_sessions list belonging to that server. However, because the locking initialization failed before the session was fully established, it was never actually inserted into the http_server->ws_sessions linked list. Consequently, attempting to remove an element from a doubly-linked queue without having previously added it results in undefined behavior, typically manifesting as corruption of adjacent memory structures or immediate dereference of invalid pointers.
From an operational perspective, this vulnerability allows for denial-of-service attacks against any service utilizing libevent with WebSocket support enabled. A local attacker who can induce the specific conditions triggering the locking failure—such as exhausting system resources to cause allocation failures or manipulating socket states to trigger lock contention errors—can crash the hosting process. This instability undermines the reliability and availability of services relying on libevent for concurrent network I/O handling, potentially leading to service outages that require manual intervention or restarts to restore functionality.
This flaw aligns with CWE-416, Use After Free, although in this specific context it more accurately reflects a logic error resulting in invalid memory access due to improper list manipulation without proper state validation. It also relates to CWE-252, unchecked return value, as the code did not adequately verify that all prerequisite setup steps completed successfully before proceeding with cleanup routines that assume full initialization. In terms of MITRE ATT&CK mapping, this vulnerability facilitates Denial of Service (T1499) by exploiting resource exhaustion or state manipulation to disrupt service availability.
Mitigation strategies primarily involve upgrading libevent to version 2.2.2-alpha or later, where the developers have corrected the logic in evws_connection_free to ensure that TAILQ_REMOVE is only called if the session was successfully added to the list. For organizations unable to immediately upgrade, implementing robust error handling around bufferevent_enable_locking_ calls and ensuring strict validation of pointer states before performing queue operations can provide temporary relief. Additionally, deploying runtime protection mechanisms such as Address Sanitizer during development testing or using memory-safe wrappers in production environments can help detect similar logic errors early in the software lifecycle. Regular patch management and dependency auditing are essential to maintain security posture against such low-level system library vulnerabilities.