CVE-2026-63384

Name of the Vulnerable Software and Affected Versions Libevent versions prior to 2.1.13 Libevent versions prior to 2.2.2-alpha

Description An incorrect integer conversion occurs in event tagging.c when the evtag unmarshal header() function uses evtag decode int() to decode a uint32 payload length controlled by an attacker and returns it as a signed int. When values exceed INT MAX, they become negative or truncated. Subsequently, evtag unmarshal string() may use this converted value for allocation sizing, leading to a wrapped large allocation request and a denial of service.

Recommendations Update to version 2.1.13. Update to version 2.2.2-alpha.