CVE-2026-63495
CVE-2026-63495: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityHigh7.5
High [CVE-2026-63495] Remote denial of service via unbounded memory accumulation in WebSocket server
CVE-2026-63495Source published Source updated
Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha. A flaw was found in Libevent. Due to a lack of a total message-size limit, these fragmented frames accumulate in memory without bound, leading to memory exhaustion and a denial of service (DoS) for the process or host. Important: A remote denial of service flaw exists in the libevent WebSocket server due to unbounded…
- Affected products in this advisory
- Red Hat Hardened Images
- Red Hat Enterprise Linux 6
- Red Hat OpenShift Container Platform 4
- Red Hat package: libevent2
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- 2.2.2
- libevent-main-2.1.12-19.hum1
- RHSA-2026:41176
- Mitigation guidance
- To mitigate this issue, disable any services that expose the libevent WebSocket server if its functionality is not required. If the libevent WebSocket server is necessary, restrict network access to trusted clients or networks by implementing appropriate firewall rules to limit exposure.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.