Critical libevent Vulnerabilities Affecting Multiple Ubuntu Versions

• •Two critical vulnerabilities in libevent affect multiple Ubuntu LTS versions.
• •Remote and local attackers can exploit these flaws for denial of service or code execution.
• •Patches are available; immediate updates are recommended for affected systems.

Two vulnerabilities in the libevent library were discovered by Michał Majchrowicz and Marcin Wyczechowski, allowing remote and local attackers to potentially execute arbitrary code or cause denial of service. The vulnerabilities, identified as CVE-2026-63387 and CVE-2026-63388, affect Ubuntu versions 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, and 26.04 LTS. Users are advised to update their systems to mitigate these risks. The vulnerabilities were published on August 20, 2026, and are confirmed to be exploitable. Affected users should prioritize applying the available patches to secure their systems. The issues stem from improper handling of DNS responses and connections within the library. CISA has confirmed the exploitation of these vulnerabilities, emphasizing the urgency of the situation.