elsa-2026-67908
oracle_linux
Description
[2.1.8-11] - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Resolves: RHEL-253566 [2.1.8-10] - Fix CVE-2026-63387: out-of-bounds write in evdns dnsname_to_labels - Resolves: RHEL-249889 [2.1.8-9] - Fix CVE-2026-63383: out-of-bounds read in decode_tag_internal - Resolves: RHEL-250240 [2.1.8-8] - Fix CVE-2026-63384: integer overflow in evtag_unmarshal_header - Resolves: RHEL-250071 [2.1.8-7] - Fix CVE-2026-63388: heap out-of-bounds write via AF_UNIX+http+NDEBUG - Resolves: RHEL-250045 [2.1.8-6] - Fix CVE-2026-63382: HTTP request smuggling via Transfer-Encoding - Resolves: RHEL-253525
Timeline
- Published
- unknown
- Last Modified
- unknown
CVSS Details
CVSS details not available.
Affected Products
No product information available.
References
No references available.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cves": [
"CVE-2026-63382",
"CVE-2026-63383",
"CVE-2026-63384",
"CVE-2026-63385",
"CVE-2026-63387",
"CVE-2026-63388"
],
"cvss": 0.0,
"database_specific": {
"severity": "IMPORTANT"
},
"description": "[2.1.8-11]\n- Fix CVE-2026-63385: HTTP header injection via CRLF in header values\n- Resolves: RHEL-253566\n\n[2.1.8-10]\n- Fix CVE-2026-63387: out-of-bounds write in evdns dnsname_to_labels\n- Resolves: RHEL-249889\n\n[2.1.8-9]\n- Fix CVE-2026-63383: out-of-bounds read in decode_tag_internal\n- Resolves: RHEL-250240\n\n[2.1.8-8]\n- Fix CVE-2026-63384: integer overflow in evtag_unmarshal_header\n- Resolves: RHEL-250071\n\n[2.1.8-7]\n- Fix CVE-2026-63388: heap out-of-bounds write via AF_UNIX+http+NDEBUG\n- Resolves: RHEL-250045\n\n[2.1.8-6]\n- Fix CVE-2026-63382: HTTP request smuggling via Transfer-Encoding\n- Resolves: RHEL-253525",
"id": "ELSA-2026-67908",
"ovalId": "oval:com.oracle.elsa:def:202667908",
"source": "oracle_linux",
"title": "ELSA-2026-67908: libevent security update (IMPORTANT)",
"url": "https://linux.oracle.com/errata/ELSA-2026-67908.html"
}