Amazon Linux 2023 Security Advisory: ALAS2023-2026-2128
Advisory Released Date: 2026-09-14
Advisory Updated Date: 2026-09-14
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha. (CVE-2026-63383)
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha. (CVE-2026-63384)
Affected Packages:
libevent
Issue Correction:
Run dnf update libevent --releasever 2023.12.20260914 or dnf update --advisory ALAS2023-2026-2128 --releasever 2023.12.20260914 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
libevent-debugsource-2.1.12-3.amzn2023.0.4.aarch64
libevent-debuginfo-2.1.12-3.amzn2023.0.4.aarch64
libevent-devel-2.1.12-3.amzn2023.0.4.aarch64
libevent-2.1.12-3.amzn2023.0.4.aarch64
noarch:
libevent-doc-2.1.12-3.amzn2023.0.4.noarch
src:
libevent-2.1.12-3.amzn2023.0.4.src
x86_64:
libevent-debuginfo-2.1.12-3.amzn2023.0.4.x86_64
libevent-devel-2.1.12-3.amzn2023.0.4.x86_64
libevent-2.1.12-3.amzn2023.0.4.x86_64
libevent-debugsource-2.1.12-3.amzn2023.0.4.x86_64