Medium [CVE-2026-63380] Denial of Service via Null Pointer Dereference

Libevent is an event notification library.

Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions.

A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.

This vulnerability allows a local attacker to trigger a null pointer dereference during specific error handling within the `evws_new_session` function. By inducing an allocation or locking failure, an attacker can cause the application to crash, leading to a denial of service.

Moderate impact. This flaw allows a local caller to induce specific allocation or locking failures during websocket session creation, leading to a denial of service.

Exploitation is limited to applications utilizing Libevent's websocket functionality and exposed to untrusted local input. The vulnerable code module has only ever shipped as part of the 2.2.x development/alpha line, culminating in the 2.2.2-alpha release that fixes this issue.

It was never backported into the 2.1.x stable series. Red Hat severity: Moderate — CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H).