CVE-2026-63380

Name of the Vulnerable Software and Affected Versions Libevent versions prior to 2.2.2-alpha

Description Libevent can dereference invalid list pointers in the ws.c file. This occurs when the evws new session() function enters an error path after evhttp start ws () succeeds but bufferevent enable locking () fails. In this scenario, evws connection free() identifies a non-null http server and calls TAILQ REMOVE() unconditionally, despite the session not being inserted into http server->ws sessions. A local caller capable of inducing this allocation or locking failure can cause the process to crash.

Recommendations Update to version 2.2.2-alpha.