CVE-2026-63495

Name of the Vulnerable Software and Affected Versions Libevent versions 2.2.0-alpha-dev through 2.2.2-alpha

Description The WebSocket server in ws.c fails to enforce a total message-size limit when accumulating fragmented frames in evws->incomplete frames. An unauthenticated remote client can send multiple fragmented WebSocket frames with the FIN flag set to 0, provided they remain below the WS MAX RECV FRAME SZ threshold. This causes the evbuffer to grow indefinitely, potentially leading to memory exhaustion on the host or process.

Recommendations Update Libevent to version 2.2.2-alpha.