USN-8840-1: libevent vulnerabilities
Ubuntu patched libevent flaws that could allow remote or local denial of service or code execution.
Ubuntu USN-8840-1 covers two libevent flaws. CVE-2026-63387, found by Michał Majchrowicz and Marcin Wyczechowski, involves incorrect handling of certain DNS responses and could let a remote attacker cause a denial of service or execute arbitrary code. CVE-2026-63388 involves incorrect connection handling and could let a local attacker do the same; it affects Ubuntu 18.04, 20.04, 22.04, 24.04, and 26.04 LTS. The notice does not report in-the-wild exploitation.
- CVE-2026-63387: malformed DNS responses may allow remote denial of service or code execution.
- CVE-2026-63388: flawed connection handling may allow local denial of service or code execution.
- The local issue affects Ubuntu 18.04 through 26.04 LTS.
- The notice does not report exploitation in the wild.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-63388+1 related CVE | Libevent: Libevent has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied… | 8.4 group max | <1% |
From the original article
Michał Majchrowicz and Marcin Wyczechowski discovered that libevent incorrectly handled certain DNS responses. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2026-63387) It was discovered that libevent incorrectly handled certain connections.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.