High [CVE-2026-63495] Remote denial of service via unbounded memory accumulation in WebSocket server
This high-severity Red Hat Linux advisory covers CVE-2026-63495 affecting Red Hat Hardened Images, Red Hat Enterprise Linux 6, Red Hat OpenShift Container Platform 4.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit.
An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.
A flaw was found in Libevent. Due to a lack of a total message-size limit, these fragmented frames accumulate in memory without bound, leading to memory exhaustion and a denial of service (DoS) for the process or host.
Important: A remote denial of service flaw exists in the libevent WebSocket server due to unbounded memory accumulation. An unauthenticated attacker can exploit this by sending fragmented WebSocket frames, leading to memory exhaustion and service unavailability.
This is rated Important because it allows a remote attacker to cause a complete denial of service without authentication or user interaction, impacting the availability of affected systems. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-770. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat OpenShift Container Platform 4.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
- 2.2.2
- libevent-main-2.1.12-19.hum1
- RHSA-2026:41176
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Mitigation checklist
- To mitigate this issue, disable any services that expose the libevent WebSocket server if its functionality is not required. If the libevent WebSocket server is necessary, restrict network access to trusted clients or networks by implementing appropriate firewall rules to limit exposure.
Official advisory · high-confidence parse· fetched 14 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.