CyberRota Analysis
AI-GeneratedLibevent versions prior to 2.1.13 and 2.2.2-alpha are vulnerable to an out-of-bounds read due to improper handling of fragmented evbuffers in the event_tagging.c file, which can lead to process crashes when decoding maliciously crafted tagged RPC data. This vulnerability poses a high risk, particularly for applications relying on Libevent for event notification, and should be prioritized by developers and system administrators using affected versions to mitigate potential denial-of-service attacks. Immediate updates to the patched versions are recommended to ensure system stability and security.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.