Libevent up to 2.1.12/2.2.1 DNS Server Request Formatting evdns.c dnsname_to_labels off-by-one

Summaryinfo

A vulnerability was found in Libevent up to 2.1.12/2.2.1. It has been classified as critical. Affected by this vulnerability is the function dnsname_to_labels of the file evdns.c of the component DNS Server Request Formatting. This manipulation causes off-by-one. This vulnerability is handled as CVE-2026-63387. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Libevent up to 2.1.12/2.2.1. It has been declared as critical. Affected by this vulnerability is the function dnsname_to_labels of the file evdns.c of the component DNS Server Request Formatting. The manipulation with an unknown input leads to a off-by-one vulnerability. The CWE definition for the vulnerability is CWE-193. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-63387 since 07/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.1.13 or 2.2.2-alpha eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Libevent

Version

• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.1.10
• 2.1.11
• 2.1.12
• 2.2.0
• 2.2.1

Website

• Product: https://github.com/libevent/libevent/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion