{"cves":["CVE-2026-63382","CVE-2026-63383","CVE-2026-63384","CVE-2026-63385","CVE-2026-63387","CVE-2026-63388"],"cvss":0.0,"database_specific":{"severity":"IMPORTANT"},"description":"[2.1.8-11]\n- Fix CVE-2026-63385: HTTP header injection via CRLF in header values\n- Resolves: RHEL-253566\n\n[2.1.8-10]\n- Fix CVE-2026-63387: out-of-bounds write in evdns dnsname_to_labels\n- Resolves: RHEL-249889\n\n[2.1.8-9]\n- Fix CVE-2026-63383: out-of-bounds read in decode_tag_internal\n- Resolves: RHEL-250240\n\n[2.1.8-8]\n- Fix CVE-2026-63384: integer overflow in evtag_unmarshal_header\n- Resolves: RHEL-250071\n\n[2.1.8-7]\n- Fix CVE-2026-63388: heap out-of-bounds write via AF_UNIX+http+NDEBUG\n- Resolves: RHEL-250045\n\n[2.1.8-6]\n- Fix CVE-2026-63382: HTTP request smuggling via Transfer-Encoding\n- Resolves: RHEL-253525","id":"ELSA-2026-67908","ovalId":"oval:com.oracle.elsa:def:202667908","source":"oracle_linux","title":"ELSA-2026-67908:  libevent security update (IMPORTANT)","url":"https://linux.oracle.com/errata/ELSA-2026-67908.html"}