Back Linuxsecurity

Ubuntu libevent Important Denial of Service or Code Exec USN-8840

Linuxsecurity •LinuxSecurity Advisories • September 29, 2026

CISA confirms exploitation of a Linux firewall flaw. Check if your systems need the fix. ×

Several security issues were fixed in libevent. Software Description: - libevent: Event notification library Details: Michał Majchrowicz and Marcin Wyczechowski discovered that libevent incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-63387) It was discovered that libevent incorrectly handled certain connections. A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63388)

Several security issues were fixed in libevent.

Software Description:

- libevent: Event notification library

Michał Majchrowicz and Marcin Wyczechowski discovered that libevent

incorrectly handled certain DNS responses. A remote attacker could possibly

use this issue to cause a denial of service or execute arbitrary code.

It was discovered that libevent incorrectly handled certain connections. A

local attacker could possibly use this issue to cause a denial of service

or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,

Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS libevent-2.1-7t64 2.1.12-stable-10ubuntu0.2 libevent-core-2.1-7t64 2.1.12-stable-10ubuntu0.2 libevent-dev 2.1.12-stable-10ubuntu0.2 libevent-extra-2.1-7t64 2.1.12-stable-10ubuntu0.2 libevent-openssl-2.1-7t64 2.1.12-stable-10ubuntu0.2 libevent-pthreads-2.1-7t64 2.1.12-stable-10ubuntu0.2 Ubuntu 24.04 LTS libevent-2.1-7t64 2.1.12-stable-9ubuntu2.2 libevent-core-2.1-7t64 2.1.12-stable-9ubuntu2.2 libevent-dev 2.1.12-stable-9ubuntu2.2 libevent-extra-2.1-7t64 2.1.12-stable-9ubuntu2.2 libevent-openssl-2.1-7t64 2.1.12-stable-9ubuntu2.2 libevent-pthreads-2.1-7t64 2.1.12-stable-9ubuntu2.2 Ubuntu 22.04 LTS libevent-2.1-7 2.1.12-stable-1ubuntu0.2 libevent-core-2.1-7 2.1.12-stable-1ubuntu0.2 libevent-dev 2.1.12-stable-1ubuntu0.2 libevent-extra-2.1-7 2.1.12-stable-1ubuntu0.2 libevent-openssl-2.1-7 2.1.12-stable-1ubuntu0.2 libevent-pthreads-2.1-7 2.1.12-stable-1ubuntu0.2 Ubuntu 20.04 LTS libevent-2.1-7 2.1.11-stable-1ubuntu0.1~esm2 Available with Ubuntu Pro libevent-core-2.1-7 2.1.11-stable-1ubuntu0.1~esm2 Available with Ubuntu Pro libevent-dev 2.1.11-stable-1ubuntu0.1~esm2 Available with Ubuntu Pro libevent-extra-2.1-7 2.1.11-stable-1ubuntu0.1~esm2 Available with Ubuntu Pro libevent-openssl-2.1-7 2.1.11-stable-1ubuntu0.1~esm2 Available with Ubuntu Pro libevent-pthreads-2.1-7 2.1.11-stable-1ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 18.04 LTS libevent-2.1-6 2.1.8-stable-4ubuntu0.1~esm2 Available with Ubuntu Pro libevent-core-2.1-6 2.1.8-stable-4ubuntu0.1~esm2 Available with Ubuntu Pro libevent-dev 2.1.8-stable-4ubuntu0.1~esm2 Available with Ubuntu Pro libevent-extra-2.1-6 2.1.8-stable-4ubuntu0.1~esm2 Available with Ubuntu Pro libevent-openssl-2.1-6 2.1.8-stable-4ubuntu0.1~esm2 Available with Ubuntu Pro libevent-pthreads-2.1-6 2.1.8-stable-4ubuntu0.1~esm2 Available with Ubuntu Pro Ubuntu 16.04 LTS libevent-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm2 Available with Ubuntu Pro libevent-core-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm2 Available with Ubuntu Pro libevent-dev 2.0.21-stable-2ubuntu0.16.04.1+esm2 Available with Ubuntu Pro libevent-extra-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm2 Available with Ubuntu Pro libevent-openssl-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm2 Available with Ubuntu Pro libevent-pthreads-2.0-5 2.0.21-stable-2ubuntu0.16.04.1+esm2 Available with Ubuntu Pro Ubuntu 14.04 LTS libevent-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm2 Available with Ubuntu Pro libevent-core-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm2 Available with Ubuntu Pro libevent-dev 2.0.21-stable-1ubuntu1.14.04.2+esm2 Available with Ubuntu Pro libevent-extra-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm2 Available with Ubuntu Pro libevent-openssl-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm2 Available with Ubuntu Pro libevent-pthreads-2.0-5 2.0.21-stable-1ubuntu1.14.04.2+esm2 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2026-63387, CVE-2026-63388

Ubuntu Security Notice USN-8840-1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical libevent Vulnerabilities Affecting Multiple Ubuntu Versions Two vulnerabilities in the libevent library were discovered by Michał Majchrowicz and Marcin Wyczechowski, allowing remote and local attackers to potentially execute arbitrary code or cause denial of service. The vulnerabilities, identified as CVE-2026-63387 and CVE-2026-63388, affect Ubuntu versions 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 26.04 LTS. Users are advised to update their systems to mitigate these risks. The vulnerabilities were published on August 20, 2026, and are confirmed to be exploitable. Affected users should prioritize applying the available patches to secure their systems. The issues stem from improper handling of DNS responses and connections within the library. CISA has confirmed the exploitation of these vulnerabilities, emphasizing the urgency of the situation. 2 sources 74

Extracted Entities

Ubuntu libevent Important Denial of Service or Code Exec USN-8840

The full story

Extracted Entities

Attack Types (2)

Companies (1)

CVEs (2)