{"cvss":7.0,"datePublished":"2026-08-20T18:16:36.723","dateUpdated":"2026-10-26T10:10:00.140","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.","id":"CVE-2026-63387","raw":{"affected":[{"affectedData":[{"product":"libevent","vendor":"libevent","versions":[{"status":"affected","version":">= 2.2.0-alpha, < 2.2.2-alpha"},{"status":"affected","version":"< 2.1.13"}]}],"source":"security-advisories@github.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."},{"lang":"es","value":"Libevent es una biblioteca de notificación de eventos. Antes de 2.1.13 y 2.2.2-alpha, libevent tiene un desbordamiento de búfer de pila por un byte en evdns.c cuando dnsname_to_labels formatea un registro DNS que contiene un nombre al final del búfer de pila de 64 KB asignado por evdns_server_request_format_response. La verificación de la etiqueta final permite que j más label_len más uno sea igual a buf_len, después de lo cual el byte nulo de terminación se escribe en buf[buf_len]. Una respuesta de servidor DNS manipulada que contiene datos PTR, CNAME, MX, NS o SOA puede desencadenar la escritura fuera de límites de un byte y bloquear o corromper el proceso. Este problema está solucionado en las versiones 2.1.13 y 2.2.2-alpha."}],"id":"CVE-2026-63387","lastModified":"2026-10-26T10:10:00.140","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.0,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","version":"3.1"},"exploitabilityScore":2.2,"impactScore":4.7,"source":"security-advisories@github.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-63387","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-25T15:11:49.042805Z","version":"2.0.3"}}]},"published":"2026-08-20T18:16:36.723","references":[{"source":"security-advisories@github.com","url":"https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"},{"source":"security-advisories@github.com","url":"https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"},{"source":"security-advisories@github.com","url":"https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47"},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","url":"https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47"}],"sourceIdentifier":"security-advisories@github.com","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-121"},{"lang":"en","value":"CWE-193"},{"lang":"en","value":"CWE-787"}],"source":"security-advisories@github.com","type":"Secondary"}]},"severity":"HIGH","source":"nvd","title":"Libevent is an event notification library"}