-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6493-1 [email protected]
https://www.debian.org/security/ Aron Xu
September 11, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libevent
CVE ID : CVE-2026-63379 CVE-2026-63381 CVE-2026-63382 CVE-2026-63383
CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388
Several vulnerabilities were discovered in libevent, an asynchronous event
notification library.
The HTTP implementation (evhttp) handled Transfer-Encoding and
Content-Length headers, chunked-encoding line terminators, header line
folding and chunked trailers too permissively, which could allow HTTP
request smuggling, header injection or access control bypass when a
libevent-based server or client is combined with an HTTP proxy.
Out-of-bounds memory accesses in the DNS (evdns), tagged RPC
(evtag/evrpc) and buffered socket (bufferevent) code, and a
use-after-free in evbuffer, could result in denial of service or
potentially the execution of arbitrary code when processing untrusted
input.
For the stable distribution (trixie), these problems have been fixed in
version 2.1.13-stable-1~deb13u1.
We recommend that you upgrade your libevent packages.
For the detailed security status of libevent please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libevent
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqjpDsACgkQ+GQ1dHE8
m66UlwgAgrC5PETAeCcPs0IWznLVphNNUlMHpLO1mxWas+PVMSdyu6cN7iddjSc9
dfwwlb2Oy+kaa8h0EjLmQP4pywP/8115uzFdQ4b0/xUsPzJTgQrPT8ivp55kYLso
JrHqcIGTOqenaFRJL81XdZrgw/dqnnYBkDBc1nzTfdDuNPaDZ63uw1e1YhEwdtqg
Bcmn3Rvkvn32ehpEOO5GZIHvjr87agMtLrlhlUVDd+FmNqP5dI0D0uMZIPEMmr/V
oy7hppI93rnNG4iEU/zFVoFK5pwwgo085TraLuPWVUsZ5t4uYMYVDSalFiCsvKaI
LJsdek7rIHT7j2nlMwNwlJzVgepB8g==
=S+60
-----END PGP SIGNATURE-----
