CVE-2026-63380

A flaw was found in Libevent, an event notification library. This vulnerability allows a local attacker to trigger a null pointer dereference during specific error handling within the evws_new_session function. By inducing an allocation or locking failure, an attacker can cause the application to crash, leading to a denial of service.

Moderate impact. A null pointer dereference in Libevent's websocket handling can be triggered by a local attacker. This flaw allows a local caller to induce specific allocation or locking failures during websocket session creation, leading to a denial of service. Exploitation is limited to applications utilizing Libevent's websocket functionality and exposed to untrusted local input. The vulnerable code module has only ever shipped as part of the 2.2.x development/alpha line, culminating in the 2.2.2-alpha release that fixes this issue. It was never backported into the 2.1.x stable series.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.