https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T18:22:49.388470+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:67908 ALSA-2026:67908 — Important: libevent security update 2026-10-03T18:22:49.794510+00:00

Affected: AlmaLinux:8: libevent, AlmaLinux:8: libevent-devel, AlmaLinux:8: libevent-doc

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383) * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387) * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384) * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382) * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388) * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-12663 bdu:2026-12663 2026-10-03T18:22:49.794589+00:00 bdu:2026-12663 https://cve.radiocsirt.org/vuln/bell-cve-2026-63387 BELL-CVE-2026-63387 2026-10-03T18:22:49.794607+00:00

Affected: Alpaquita:23: libevent, Alpaquita:25: libevent, Alpaquita:stream: libevent, BellSoft Hardened Containers:23: libevent, BellSoft Hardened Containers:25: libevent, BellSoft Hardened Containers:stream: libevent

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T18:22:49.794634+00:00 certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/euvd-2026-358740 EUVD-2026-358740 2026-10-03T18:22:49.794650+00:00 EUVD-2026-358740 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63387 fkie_cve-2026-63387 2026-10-03T18:22:49.794661+00:00

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-63387 msrc_CVE-2026-63387 — Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response 2026-10-03T18:22:49.794684+00:00 msrc_CVE-2026-63387 https://cve.radiocsirt.org/vuln/oesa-2026-3268 OESA-2026-3268 — libevent security update 2026-10-03T18:22:49.794700+00:00

Affected: openEuler:24.03-LTS-SP4: libevent, openEuler:20.03-LTS-SP4: libevent, openEuler:22.03-LTS-SP4: libevent, openEuler:24.03-LTS-SP1: libevent, openEuler:24.03-LTS-SP3: libevent

Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor. Security Fix(es):

The updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)

The updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)

The updated packages fix some security vulnerabilities.(CVE-2026-63382)

The updated packages fix some security vulnerabilities.(CVE-2026-63383)

The updated packages fix some security vulnerabilities.(CVE-2026-63384)

The updated packages fix some security vulnerabilities.(CVE-2026-63385)

The updated packages fix some security vulnerabilities.(CVE-2026-63387)

The updated packages fix some security vulnerabilities.(CVE-2026-63388)

 https://cve.radiocsirt.org/vuln/rhsa-2026:63388 RHSA-2026:63388 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-03T18:22:49.794735+00:00

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling libevent: Libevent: HTTP header handling bugs create risk of access control bypass. libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption

 https://cve.radiocsirt.org/vuln/rhsa-2026:67908 RHSA-2026:67908 — Red Hat Security Advisory: libevent security update 2026-10-03T18:22:49.794756+00:00

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling libevent: Libevent: Denial of Service via malformed RPC data libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` libevent: Libevent: HTTP header handling bugs create risk of access control bypass. libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

 https://cve.radiocsirt.org/vuln/rlsa-2026:67908 RLSA-2026:67908 — Important: libevent security update 2026-10-03T18:22:49.794779+00:00

Affected: Rocky Linux:8: libevent

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

* libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

* libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)

* libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

* libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

* libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-63387 UBUNTU-CVE-2026-63387 2026-10-03T18:22:49.794806+00:00

Affected: Ubuntu:Pro:14.04:LTS: libevent, Ubuntu:Pro:16.04:LTS: libevent, Ubuntu:Pro:18.04:LTS: libevent, Ubuntu:Pro:20.04:LTS: libevent, Ubuntu:22.04:LTS: libevent, Ubuntu:24.04:LTS: libevent, Ubuntu:26.04:LTS: libevent

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3419 WID-SEC-W-2026-3419 — Red Hat Enterprise Linux (corosync, libevent, libsoup): Mehrere Schwachstellen 2026-10-03T18:22:49.794834+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände herbeizuführen.