CyberRota Analysis
AI-GeneratedLibevent versions prior to 2.2.2-alpha are vulnerable to a flaw that can lead to process crashes due to improper handling of invalid list pointers during WebSocket session management. Specifically, if a local attacker can trigger an allocation or locking failure, they may exploit this vulnerability to crash the affected application. Organizations using Libevent for WebSocket functionality should prioritize upgrading to version 2.2.2-alpha to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free sees a non-null http_server and unconditionally calls TAILQ_REMOVE even though the session was never inserted into http_server->ws_sessions. A local caller able to induce this allocation or locking failure can crash the process. This issue is fixed in version 2.2.2-alpha.