Ubuntu alert USN-8710-1 (libevent)
| From: | noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-8710-1] libevent vulnerabilities | |
| Date: | Tue, 01 Sep 2026 19:06:03 +0000 | |
| Message-ID: | <E1x1To3-00030c-0G@lists.ubuntu.com> | |
| Cc: | noreply+usn-bot@canonical.com |
========================================================================== Ubuntu Security Notice USN-8710-1 September 01, 2026 libevent vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 LTS - Ubuntu 14.04 LTS Summary: Several security issues were fixed in libevent. Software Description: - libevent: Event notification library Details: Alexis Challande discovered that libevent incorrectly handled certain empty output buffers. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63381) Rajat Raghav discovered that libevent incorrectly handled certain HTTP requests. An attacker could possibly use this issue to desynchronize HTTP request boundaries, resulting in HTTP request smuggling. (CVE-2026-63382) Qiu Sihao discovered that libevent incorrectly handled certain malformed tagged RPC data. An attacker could possibly use this issue to trigger an out-of-bounds read, resulting in a denial of service. (CVE-2026-63383) Qiu Sihao discovered that libevent incorrectly handled certain large payload lengths in tagged RPC data. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. (CVE-2026-63384) Asaf Meizner discovered that libevent incorrectly handled certain HTTP URIs and header values. An attacker could possibly use this issue to cause HTTP messages to be interpreted inconsistently, resulting in security restrictions being bypassed. (CVE-2026-63385) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libevent-2.1-7t64 2.1.12-stable-10ubuntu0.1 libevent-core-2.1-7t64 2.1.12-stable-10ubuntu0.1 libevent-dev 2.1.12-stable-10ubuntu0.1 libevent-extra-2.1-7t64 2.1.12-stable-10ubuntu0.1 Ubuntu 24.04 LTS libevent-2.1-7t64 2.1.12-stable-9ubuntu2.1 libevent-core-2.1-7t64 2.1.12-stable-9ubuntu2.1 libevent-dev 2.1.12-stable-9ubuntu2.1 libevent-extra-2.1-7t64 2.1.12-stable-9ubuntu2.1 Ubuntu 22.04 LTS libevent-2.1-7 2.1.12-stable-1ubuntu0.1 libevent-core-2.1-7 2.1.12-stable-1ubuntu0.1 libevent-dev 2.1.12-stable-1ubuntu0.1 libevent-extra-2.1-7 2.1.12-stable-1ubuntu0.1 Ubuntu 20.04 LTS libevent-2.1-7 2.1.11-stable-1ubuntu0.1~esm1 Available with Ubuntu Pro libevent-core-2.1-7 2.1.11-stable-1ubuntu0.1~esm1 Available with Ubuntu Pro libevent-dev 2.1.11-stable-1ubuntu0.1~esm1 Available with Ubuntu Pro libevent-extra-2.1-7 2.1.11-stable-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libevent-2.1-6 2.1.8-stable-4ubuntu0.1~esm1 Available with Ubuntu Pro libevent-core-2.1-6 2.1.8-stable-4ubuntu0.1~esm1 Available with Ubuntu Pro libevent-dev 2.1.8-stable-4ubuntu0.1~esm1 Available with Ubuntu Pro libevent-extra-2.1-6 2.1.8-stable-4ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libevent-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm1 Available with Ubuntu Pro libevent-core-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm1 Available with Ubuntu Pro libevent-dev 2.0.21-stable-2ubuntu0.16.04.1+esm1 Available with Ubuntu Pro libevent-extra-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm1 Available with Ubuntu Pro Ubuntu 14.04 LTS libevent-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm1 Available with Ubuntu Pro libevent-core-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm1 Available with Ubuntu Pro libevent-dev 2.0.21-stable-1ubuntu1.14.04.2+esm1 Available with Ubuntu Pro libevent-extra-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-8710-1 CVE-2026-63381, CVE-2026-63382, CVE-2026-63383, CVE-2026-63384, CVE-2026-63385 Package Information: https://launchpad.net/ubuntu/+source/libevent/2.1.12-stab... https://launchpad.net/ubuntu/+source/libevent/2.1.12-stab... https://launchpad.net/ubuntu/+source/libevent/2.1.12-stab...
Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmqXIgwACgkQcpJm3tlz hgG0/xAAzCQhYsrUkq5HF/0TsH0Ss67k0ZhZEc+QDVJnDC3XCOfXrR2C1ljiGH/o 6xa90U9tCy8rvJpiEwp5zmVnWcTZ24KmsXqfNwdsKrnFc9tUKwBUfr9MXb91+05S 26Og07oVMueQ9hqknEQpS9beoO4gaPVSYhXItSX8u9r5XtR3yS4NSrbLK5L+Zzu1 XJqy+PVY3YqGOsS6NpAcn9WoPbQTj8exJUhhAqj4o3mJcFFRdgZvHfFXbITgaZuU jsXOs8JOkMWi36NAasRY+6iWhOfVW7ZWDGTJxJw6FpAHpZcpmIJckvyn79Ib2OQL qXHkYFJZ0XoIXQvBJzqsATwcyFqLqoiaCs9BOoxIOtmJG/KbX5sqJn6Y8KS5dyxl Dg2qJ/fzFRts1LatbCcgq/CXQN+UkeypeD2fFTbc5OkNL3DKE7/0fTOzzQsnWD9v F+Mw5iRC/Ev+GT8xwueAHOXASgKcYEvAhh9cV9mAUdWCDpXXk/EJtdfeR/T3yRBm gg68v7LTtuSaArvUyiEMim+EVpOUn+YZ9/W6PDsIT07LykWKCoKnXwVbnLceC8dZ nztfcgAUCIkjn8jEqS6Sy1/NiX+MiLxyv6lGul0kjjWT1/slt0sSwd/mghZg86VN skWpFUQxG/keWAHXM5DtShIUtIOtFtHgLqCMupH6A5NnoY4aQ+8= =xzGk -----END PGP SIGNATURE-----