Back Linuxsecurity

Ubuntu 8710-1 Libevent Important Use-After

Linuxsecurity •LinuxSecurity Advisories • September 1, 2026

Find practical guidance for preventing, investigating, and responding to Linux security problems. Review Linux Privileges ×

Several security issues were fixed in libevent. Software Description: - libevent: Event notification library Details: Alexis Challande discovered that libevent incorrectly handled certain empty output buffers. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63381) Rajat Raghav discovered that libevent incorrectly handled certain HTTP requests. An attacker could possibly use this issue to desynchronize HTTP request boundaries, resulting in HTTP request smuggling. (CVE-2026-63382) Qiu Sihao discovered that libevent incorrectly handled certain malformed tagged RPC data. An attacker could possibly use this issue to trigger an out-of-bounds read, resulting in a denial of service. (CVE-2026-63383) Qiu Sihao discovered that libevent incorrectly handled certain large payloa... Read the Full Advisory

Several security issues were fixed in libevent.

Software Description:

- libevent: Event notification library

Alexis Challande discovered that libevent incorrectly handled certain

empty output buffers. An attacker could possibly use this issue to

trigger a use-after-free, resulting in a denial of service or arbitrary

code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04

LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.

Rajat Raghav discovered that libevent incorrectly handled certain HTTP

requests. An attacker could possibly use this issue to desynchronize

HTTP request boundaries, resulting in HTTP request smuggling.

Qiu Sihao discovered that libevent incorrectly handled certain malformed

tagged RPC data. An attacker could possibly use this issue to trigger an

out-of-bounds read, resulting in a denial of service. (CVE-2026-63383)

Qiu Sihao discovered that libevent incorrectly handled certain large

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libevent-2.1-7t64 2.1.12-stable-10ubuntu0.1 libevent-core-2.1-7t64 2.1.12-stable-10ubuntu0.1 libevent-dev 2.1.12-stable-10ubuntu0.1 libevent-extra-2.1-7t64 2.1.12-stable-10ubuntu0.1 Ubuntu 24.04 LTS libevent-2.1-7t64 2.1.12-stable-9ubuntu2.1 libevent-core-2.1-7t64 2.1.12-stable-9ubuntu2.1 libevent-dev 2.1.12-stable-9ubuntu2.1 libevent-extra-2.1-7t64 2.1.12-stable-9ubuntu2.1 Ubuntu 22.04 LTS libevent-2.1-7 2.1.12-stable-1ubuntu0.1 libevent-core-2.1-7 2.1.12-stable-1ubuntu0.1 libevent-dev 2.1.12-stable-1ubuntu0.1 libevent-extra-2.1-7 2.1.12-stable-1ubuntu0.1 Ubuntu 20.04 LTS libevent-2.1-7 2.1.11-stable-1ubuntu0.1~esm1 Available with Ubuntu Pro libevent-core-2.1-7 2.1.11-stable-1ubuntu0.1~esm1 Available with Ubuntu Pro libevent-dev 2.1.11-stable-1ubuntu0.1~esm1 Available with Ubuntu Pro libevent-extra-2.1-7 2.1.11-stable-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 18.04 LTS libevent-2.1-6 2.1.8-stable-4ubuntu0.1~esm1 Available with Ubuntu Pro libevent-core-2.1-6 2.1.8-stable-4ubuntu0.1~esm1 Available with Ubuntu Pro libevent-dev 2.1.8-stable-4ubuntu0.1~esm1 Available with Ubuntu Pro libevent-extra-2.1-6 2.1.8-stable-4ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 16.04 LTS libevent-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm1 Available with Ubuntu Pro libevent-core-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm1 Available with Ubuntu Pro libevent-dev 2.0.21-stable-2ubuntu0.16.04.1+esm1 Available with Ubuntu Pro libevent-extra-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm1 Available with Ubuntu Pro Ubuntu 14.04 LTS libevent-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm1 Available with Ubuntu Pro libevent-core-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm1 Available with Ubuntu Pro libevent-dev 2.0.21-stable-1ubuntu1.14.04.2+esm1 Available with Ubuntu Pro libevent-extra-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2026-63381, CVE-2026-63382, CVE-2026-63383, CVE-2026-63384,

Ubuntu Security Notice USN-8710-1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in libevent Affecting Ubuntu Systems On September 1, 2026, Ubuntu published a security notice detailing multiple vulnerabilities in the libevent library, affecting Ubuntu 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 26.04 LTS. Key issues include a use-after-free vulnerability (CVE-2026-63381) that could lead to denial of service or arbitrary code execution, and HTTP request smuggling (CVE-2026-63382). Additional vulnerabilities include out-of-bounds reads (CVE-2026-63383) and excessive resource consumption (CVE-2026-63384). The vulnerabilities were discovered by researchers Alexis Challande, Rajat Raghav, and Qiu Sihao, with all CVEs published on August 20, 2026. Users are urged to update their systems to mitigate these risks. 2 sources 46

Extracted Entities

Ubuntu 8710-1 Libevent Important Use-After

The full story

Extracted Entities

Attack Types (1)

CVEs (4)

CWE Weaknesses (2)