Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-3902
Advisory Released Date: 2026-09-14
Advisory Updated Date: 2026-09-14
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha. (CVE-2026-63383)
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha. (CVE-2026-63384)
Affected Packages:
libevent
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update libevent or yum update --advisory ALAS2-2026-3902 to update your system.
aarch64:
libevent-2.0.21-4.amzn2.0.4.aarch64
libevent-devel-2.0.21-4.amzn2.0.4.aarch64
libevent-debuginfo-2.0.21-4.amzn2.0.4.aarch64
i686:
libevent-2.0.21-4.amzn2.0.4.i686
libevent-devel-2.0.21-4.amzn2.0.4.i686
libevent-debuginfo-2.0.21-4.amzn2.0.4.i686
noarch:
libevent-doc-2.0.21-4.amzn2.0.4.noarch
src:
libevent-2.0.21-4.amzn2.0.4.src
x86_64:
libevent-2.0.21-4.amzn2.0.4.x86_64
libevent-devel-2.0.21-4.amzn2.0.4.x86_64
libevent-debuginfo-2.0.21-4.amzn2.0.4.x86_64