https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T00:48:55.310821+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/alsa-2026:67908 ALSA-2026:67908 — Important: libevent security update 2026-09-30T00:48:55.373049+00:00

Affected: AlmaLinux:8: libevent, AlmaLinux:8: libevent-devel, AlmaLinux:8: libevent-doc

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383) * libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387) * libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384) * libevent ev[http:](http:) Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382) * libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388) * libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://vulnerability.circl.lu/vuln/bdu:2026-12659 bdu:2026-12659 2026-09-30T00:48:55.373245+00:00 bdu:2026-12659 https://vulnerability.circl.lu/vuln/bell-cve-2026-63382 BELL-CVE-2026-63382 2026-09-30T00:48:55.373280+00:00

Affected: Alpaquita:23: libevent, Alpaquita:25: libevent, Alpaquita:stream: libevent, BellSoft Hardened Containers:23: libevent, BellSoft Hardened Containers:25: libevent, BellSoft Hardened Containers:stream: libevent

 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-09-30T00:48:55.373329+00:00 certfr-2026-avi-1233 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63382 fkie_cve-2026-63382 2026-09-30T00:48:55.373358+00:00

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

 https://vulnerability.circl.lu/vuln/oesa-2026-3268 OESA-2026-3268 — libevent security update 2026-09-30T00:48:55.373406+00:00

Affected: openEuler:24.03-LTS-SP4: libevent, openEuler:20.03-LTS-SP4: libevent, openEuler:22.03-LTS-SP4: libevent, openEuler:24.03-LTS-SP1: libevent, openEuler:24.03-LTS-SP3: libevent

Libevent additionally provides a sophisticated framework for buffered network IO, with support for sockets, filters, rate-limiting, SSL, zero-copy file transmission, and IOCP. Libevent includes support for several useful protocols, including DNS, HTTP, and a minimal RPC framewor. Security Fix(es):

The updated packages fix some security vulnerabilities. libevent is a lightweight event notification library used for handling event loops and callback mechanisms, widely used in network applications.(CVE-2026-63379)

The updated packages fix some security vulnerabilities affecting the libevent library.(CVE-2026-63381)

The updated packages fix some security vulnerabilities.(CVE-2026-63382)

The updated packages fix some security vulnerabilities.(CVE-2026-63383)

The updated packages fix some security vulnerabilities.(CVE-2026-63384)

The updated packages fix some security vulnerabilities.(CVE-2026-63385)

The updated packages fix some security vulnerabilities.(CVE-2026-63387)

The updated packages fix some security vulnerabilities.(CVE-2026-63388)

 https://vulnerability.circl.lu/vuln/rhsa-2026:63388 RHSA-2026:63388 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update 2026-09-30T00:48:55.373475+00:00

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling libevent: Libevent: HTTP header handling bugs create risk of access control bypass. libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption

 https://vulnerability.circl.lu/vuln/rhsa-2026:67908 RHSA-2026:67908 — Red Hat Security Advisory: libevent security update 2026-09-30T00:48:55.373515+00:00

libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling libevent: Libevent: Denial of Service via malformed RPC data libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` libevent: Libevent: HTTP header handling bugs create risk of access control bypass. libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling

 https://vulnerability.circl.lu/vuln/rlsa-2026:67908 RLSA-2026:67908 — Important: libevent security update 2026-09-30T00:48:55.373562+00:00

Affected: Rocky Linux:8: libevent

The libevent packages provide an abstract asynchronous event notification library.

Security Fix(es):

* libevent: Libevent: Denial of Service via malformed RPC data (CVE-2026-63383)

* libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption (CVE-2026-63387)

* libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header` (CVE-2026-63384)

* libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling (CVE-2026-63382)

* libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling (CVE-2026-63388)

* libevent: Libevent: HTTP header handling bugs create risk of access control bypass. (CVE-2026-63385)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-63382 UBUNTU-CVE-2026-63382 2026-09-30T00:48:55.373614+00:00

Affected: Ubuntu:Pro:14.04:LTS: libevent, Ubuntu:Pro:16.04:LTS: libevent, Ubuntu:Pro:18.04:LTS: libevent, Ubuntu:Pro:20.04:LTS: libevent, Ubuntu:22.04:LTS: libevent, Ubuntu:24.04:LTS: libevent, Ubuntu:26.04:LTS: libevent

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.