{
  "cves": [
    "CVE-2026-63382",
    "CVE-2026-63383",
    "CVE-2026-63384",
    "CVE-2026-63385",
    "CVE-2026-63387",
    "CVE-2026-63388"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[2.1.8-11]\n- Fix CVE-2026-63385: HTTP header injection via CRLF in header values\n- Resolves: RHEL-253566\n\n[2.1.8-10]\n- Fix CVE-2026-63387: out-of-bounds write in evdns dnsname_to_labels\n- Resolves: RHEL-249889\n\n[2.1.8-9]\n- Fix CVE-2026-63383: out-of-bounds read in decode_tag_internal\n- Resolves: RHEL-250240\n\n[2.1.8-8]\n- Fix CVE-2026-63384: integer overflow in evtag_unmarshal_header\n- Resolves: RHEL-250071\n\n[2.1.8-7]\n- Fix CVE-2026-63388: heap out-of-bounds write via AF_UNIX+http+NDEBUG\n- Resolves: RHEL-250045\n\n[2.1.8-6]\n- Fix CVE-2026-63382: HTTP request smuggling via Transfer-Encoding\n- Resolves: RHEL-253525",
  "id": "ELSA-2026-67908",
  "ovalId": "oval:com.oracle.elsa:def:202667908",
  "source": "oracle_linux",
  "title": "ELSA-2026-67908:  libevent security update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-67908.html"
}