https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:48:05.011849+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:67908 ALSA-2026:67908 — Important: libevent security update 2026-10-04T01:48:05.052700+00:00

Affected: AlmaLinux:8: libevent, AlmaLinux:8: libevent-devel, AlmaLinux:8: libevent-doc

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383) * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387) * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384) * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382) * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388) * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2026-12665 bdu:2026-12665 2026-10-04T01:48:05.052795+00:00 bdu:2026-12665 https://cve.radiocsirt.org/vuln/bell-cve-2026-63388 BELL-CVE-2026-63388 2026-10-04T01:48:05.052813+00:00

Affected: Alpaquita:23: libevent, Alpaquita:25: libevent, Alpaquita:stream: libevent, BellSoft Hardened Containers:23: libevent, BellSoft Hardened Containers:25: libevent, BellSoft Hardened Containers:stream: libevent

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-04T01:48:05.052840+00:00 certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/euvd-2026-357611 EUVD-2026-357611 2026-10-04T01:48:05.052855+00:00 EUVD-2026-357611 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63388 fkie_cve-2026-63388 2026-10-04T01:48:05.052866+00:00

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-63388 msrc_CVE-2026-63388 — Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept 2026-10-04T01:48:05.052889+00:00 msrc_CVE-2026-63388 https://cve.radiocsirt.org/vuln/oesa-2026-3268 OESA-2026-3268 — libevent security update 2026-10-04T01:48:05.052906+00:00

Affected: openEuler:24.03-LTS-SP4: libevent, openEuler:20.03-LTS-SP4: libevent, openEuler:22.03-LTS-SP4: libevent, openEuler:24.03-LTS-SP1: libevent, openEuler:24.03-LTS-SP3: libevent

Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor. Security Fix(es):

The updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)

The updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)

The updated packages fix some security vulnerabilities.(CVE-2026-63382)

The updated packages fix some security vulnerabilities.(CVE-2026-63383)

The updated packages fix some security vulnerabilities.(CVE-2026-63384)

The updated packages fix some security vulnerabilities.(CVE-2026-63385)

The updated packages fix some security vulnerabilities.(CVE-2026-63387)

The updated packages fix some security vulnerabilities.(CVE-2026-63388)

 https://cve.radiocsirt.org/vuln/rhsa-2026:60853 RHSA-2026:60853 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-10-04T01:48:05.052943+00:00

libevent: Libevent: HTTP header smuggling allows authorization bypass or cache poisoning libevent: Libevent: Memory corruption due to use-after-free libevent: Libevent: Denial of Service via malformed RPC data libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

 https://cve.radiocsirt.org/vuln/rhsa-2026:67908 RHSA-2026:67908 — Red Hat Security Advisory: libevent security update 2026-10-04T01:48:05.052968+00:00

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling libevent: Libevent: Denial of Service via malformed RPC data libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` libevent: Libevent: HTTP header handling bugs create risk of access control bypass. libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

 https://cve.radiocsirt.org/vuln/rlsa-2026:67908 RLSA-2026:67908 — Important: libevent security update 2026-10-04T01:48:05.052993+00:00

Affected: Rocky Linux:8: libevent

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

* libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

* libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)

* libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

* libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

* libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-63388 UBUNTU-CVE-2026-63388 2026-10-04T01:48:05.053020+00:00

Affected: Ubuntu:Pro:18.04:LTS: libevent, Ubuntu:Pro:20.04:LTS: libevent, Ubuntu:22.04:LTS: libevent, Ubuntu:24.04:LTS: libevent, Ubuntu:26.04:LTS: libevent

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3419 WID-SEC-W-2026-3419 — Red Hat Enterprise Linux (corosync, libevent, libsoup): Mehrere Schwachstellen 2026-10-04T01:48:05.053046+00:00

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder Denial-of-Service-Zustände herbeizuführen.