CVE-2026-63387

Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

State: Published
Severity: 7.0 High
Published: Aug 20, 2026
Updated: Aug 25, 2026
Reserved: Jul 16, 2026

Description

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Scores

CVSS	Score	Vector	Source
3.1	7.0 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H	GitHub_M

Weaknesses

CWE-121 Stack-based Buffer Overflow
CWE-193 Off-by-one Error
CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
libeventlibevent	>= 2.2.0-alpha, < 2.2.2-alphaAffected < 2.1.13Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.