CVE-2026-63387

Name of the Vulnerable Software and Affected Versions Libevent versions prior to 2.1.13 Libevent versions prior to 2.2.2-alpha

Description An off-by-one stack buffer overflow exists in the evdns.c file when the dnsname to labels() function formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns server request format response(). The final-label check allows a condition where the terminating null byte is written outside the buffer boundary at buf[buf len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger this one-byte out-of-bounds write, potentially leading to process corruption or a crash.

Recommendations Update to version 2.1.13. Update to version 2.2.2-alpha.