CVE-2026-63495

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.

• CWE-400
• CWE-770

• https://github.com/libevent/libevent/commit/291c4d1cd75695e898030ebd5c4ddf26c094077b
• https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
• https://github.com/libevent/libevent/security/advisories/GHSA-qx89-wf2v-vgmx
• https://github.com/libevent/libevent/security/advisories/GHSA-qx89-wf2v-vgmx

Published

Aug 20, 2026

Last Modified

Sep 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63466Unleash is an open-source feature management platform. Prior…4.1
• CVE-2026-6347Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…7.6
• CVE-2026-6348WinMatrix agent developed by Simopro Technology has a Missin…9.3
• CVE-2026-63481Hurl is a command line tool that runs and tests HTTP request…6.9
• CVE-2026-6349The  iSherlock developed by HGiga  has an OS Command Injecti…9.8
• CVE-2026-63490Handlebars.java provides logic-less and semantic Mustache te…7.5
• CVE-2026-6350MailGates/MailAudit developed by Openfind has a Stack-based …9.8
• CVE-2026-63508Missing authentication for critical function in Microsoft Pl…10
• CVE-2026-63509Relative path traversal in Microsoft Fabric allows an author…8.8
• CVE-2026-6351MailGates/MailAudit developed by Openfind has a CRLF Injecti…8.7
• CVE-2026-63512Incorrect authorization in Microsoft Office SharePoint allow…6.5
• CVE-2026-63513Heap-based buffer overflow in Microsoft Office allows an una…7.8