ELSA-2026-67908

ELSA-2026-67908 - libevent security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-09-17

Description

[2.1.8-11]
- Fix CVE-2026-63385: HTTP header injection via CRLF in header values
- Resolves: RHEL-253566

[2.1.8-10]
- Fix CVE-2026-63387: out-of-bounds write in evdns dnsname_to_labels
- Resolves: RHEL-249889

[2.1.8-9]
- Fix CVE-2026-63383: out-of-bounds read in decode_tag_internal
- Resolves: RHEL-250240

[2.1.8-8]
- Fix CVE-2026-63384: integer overflow in evtag_unmarshal_header
- Resolves: RHEL-250071

[2.1.8-7]
- Fix CVE-2026-63388: heap out-of-bounds write via AF_UNIX+http+NDEBUG
- Resolves: RHEL-250045

[2.1.8-6]
- Fix CVE-2026-63382: HTTP request smuggling via Transfer-Encoding
- Resolves: RHEL-253525

Related CVEs

CVE-2026-63382

CVE-2026-63383

CVE-2026-63384

CVE-2026-63385

CVE-2026-63387

CVE-2026-63388

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	libevent-2.1.8-11.el8_10.src.rpm	cc94d2ebe3fc0e0051cb7bf136aa07fdc318f71110df74c90594a0918fa6135b	-	ol8_aarch64_appstream
	libevent-2.1.8-11.el8_10.src.rpm	cc94d2ebe3fc0e0051cb7bf136aa07fdc318f71110df74c90594a0918fa6135b	-	ol8_aarch64_baseos_latest
	libevent-2.1.8-11.el8_10.src.rpm	cc94d2ebe3fc0e0051cb7bf136aa07fdc318f71110df74c90594a0918fa6135b	-	ol8_aarch64_u10_baseos_patch
	libevent-2.1.8-11.el8_10.aarch64.rpm	57c393a1946b1762d6877919115cb82969f306e10253e86219e7bbec13bf23c2	-	ol8_aarch64_baseos_latest
	libevent-2.1.8-11.el8_10.aarch64.rpm	57c393a1946b1762d6877919115cb82969f306e10253e86219e7bbec13bf23c2	-	ol8_aarch64_u10_baseos_patch
	libevent-devel-2.1.8-11.el8_10.aarch64.rpm	c2c5f673c989cb19731a999c48f461e18700cb8d7af51e29ffe58973503a0c1f	-	ol8_aarch64_appstream
	libevent-doc-2.1.8-11.el8_10.noarch.rpm	cfae5e6cb0aee72279b93d0f0c648694bbd719416737f81030023e3b5b73133d	-	ol8_aarch64_baseos_latest
	libevent-doc-2.1.8-11.el8_10.noarch.rpm	cfae5e6cb0aee72279b93d0f0c648694bbd719416737f81030023e3b5b73133d	-	ol8_aarch64_u10_baseos_patch
Oracle Linux 8 (x86_64)	libevent-2.1.8-11.el8_10.src.rpm	cc94d2ebe3fc0e0051cb7bf136aa07fdc318f71110df74c90594a0918fa6135b	-	ol8_x86_64_appstream
	libevent-2.1.8-11.el8_10.src.rpm	cc94d2ebe3fc0e0051cb7bf136aa07fdc318f71110df74c90594a0918fa6135b	-	ol8_x86_64_baseos_latest
	libevent-2.1.8-11.el8_10.src.rpm	cc94d2ebe3fc0e0051cb7bf136aa07fdc318f71110df74c90594a0918fa6135b	-	ol8_x86_64_u10_baseos_patch
	libevent-2.1.8-11.el8_10.i686.rpm	1795dfa32fed9f3868816500fafa717ca3d01534dbc552901dfbd23bb9f456f1	-	ol8_x86_64_baseos_latest
	libevent-2.1.8-11.el8_10.i686.rpm	1795dfa32fed9f3868816500fafa717ca3d01534dbc552901dfbd23bb9f456f1	-	ol8_x86_64_u10_baseos_patch
	libevent-2.1.8-11.el8_10.x86_64.rpm	698a4f08cb4436f664f882b98f5642647169941f741537b39ed7f96ec7eddc95	-	ol8_x86_64_baseos_latest
	libevent-2.1.8-11.el8_10.x86_64.rpm	698a4f08cb4436f664f882b98f5642647169941f741537b39ed7f96ec7eddc95	-	ol8_x86_64_u10_baseos_patch
	libevent-devel-2.1.8-11.el8_10.i686.rpm	65106c180b1ee04a9e1a51da1aebca8205a0e4263a02377a991b21c6158bee54	-	ol8_x86_64_appstream
	libevent-devel-2.1.8-11.el8_10.x86_64.rpm	f28f92487078696142b13f653e3c94e1b81b906256d1d277b4c0aedc39425dfe	-	ol8_x86_64_appstream
	libevent-doc-2.1.8-11.el8_10.noarch.rpm	cfae5e6cb0aee72279b93d0f0c648694bbd719416737f81030023e3b5b73133d	-	ol8_x86_64_baseos_latest
	libevent-doc-2.1.8-11.el8_10.noarch.rpm	cfae5e6cb0aee72279b93d0f0c648694bbd719416737f81030023e3b5b73133d	-	ol8_x86_64_u10_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team