← All notices | Source (USN-8710-1) | Text version
QSN-8710-1: libevent vulnerabilities
September 1, 2026
Summary
Several security issues were fixed in libevent.
Details
Alexis Challande discovered that libevent incorrectly handled certain empty output buffers. An attacker could possibly use this issue to trigger a use-after-free, resulting in a denial of service or arbitrary code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63381)
Rajat Raghav discovered that libevent incorrectly handled certain HTTP requests. An attacker could possibly use this issue to desynchronize HTTP request boundaries, resulting in HTTP request smuggling. (CVE-2026-63382)
Qiu Sihao discovered that libevent incorrectly handled certain malformed tagged RPC data. An attacker could possibly use this issue to trigger an out-of-bounds read, resulting in a denial of service. (CVE-2026-63383)
Qiu Sihao discovered that libevent incorrectly handled certain large payload lengths in tagged RPC data. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. (CVE-2026-63384)
Asaf Meizner discovered that libevent incorrectly handled certain HTTP URIs and header values. An attacker could possibly use this issue to cause HTTP messages to be interpreted inconsistently, resulting in security restrictions being bypassed. (CVE-2026-63385)
Affected QuantaStor releases
| Release | Platform | Package | Exposure | Shipped version | Fixed version | Status |
|---|---|---|---|---|---|---|
| 6.9.1.001 | Ubuntu 22.04 LTS | libevent-core-2.1-7 | Internally-facing | 2.1.12-stable-1ubuntu0.2 | 2.1.12-stable-1ubuntu0.1 | Fixed in this release |
| 6.9.1.001 | Ubuntu 22.04 LTS | libevent-pthreads-2.1-7 | Internally-facing | 2.1.12-stable-1ubuntu0.2 | 2.1.12-stable-1ubuntu0.1 | Fixed in this release |
| 6.9.0.464 | Ubuntu 22.04 LTS | libevent-core-2.1-7 | Internally-facing | 2.1.12-stable-1ubuntu0.2 | 2.1.12-stable-1ubuntu0.1 | Fixed in this release |
| 6.9.0.464 | Ubuntu 22.04 LTS | libevent-pthreads-2.1-7 | Internally-facing | 2.1.12-stable-1ubuntu0.2 | 2.1.12-stable-1ubuntu0.1 | Fixed in this release |
| 6.8.6.015 | Ubuntu 22.04 LTS | libevent-core-2.1-7 | Internally-facing | 2.1.12-stable-1ubuntu0.1 | 2.1.12-stable-1ubuntu0.1 | Fixed in this release |
| 6.8.6.015 | Ubuntu 22.04 LTS | libevent-pthreads-2.1-7 | Internally-facing | 2.1.12-stable-1ubuntu0.1 | 2.1.12-stable-1ubuntu0.1 | Fixed in this release |
| 6.8.5.018 | Ubuntu 22.04 LTS | libevent-core-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.5.018 | Ubuntu 22.04 LTS | libevent-pthreads-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.4.038 | Ubuntu 22.04 LTS | libevent-core-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.4.038 | Ubuntu 22.04 LTS | libevent-pthreads-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.3.018 | Ubuntu 22.04 LTS | libevent-core-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.3.018 | Ubuntu 22.04 LTS | libevent-pthreads-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.2.002 | Ubuntu 22.04 LTS | libevent-core-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.2.002 | Ubuntu 22.04 LTS | libevent-pthreads-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.1.007 | Ubuntu 22.04 LTS | libevent-core-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.1.007 | Ubuntu 22.04 LTS | libevent-pthreads-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.0.205 | Ubuntu 22.04 LTS | libevent-core-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
| 6.8.0.205 | Ubuntu 22.04 LTS | libevent-pthreads-2.1-7 | Internally-facing | 2.1.12-stable-1build3 | 2.1.12-stable-1ubuntu0.1 | Fixed by QuantaStor security update |
Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.
CVEs
CVE-2026-63385, CVE-2026-63381, CVE-2026-63382, CVE-2026-63384, CVE-2026-63383
References
https://ubuntu.com/security/notices/USN-8710-1
https://nvd.nist.gov/vuln/detail/CVE-2026-63385
https://nvd.nist.gov/vuln/detail/CVE-2026-63381
https://nvd.nist.gov/vuln/detail/CVE-2026-63382
https://nvd.nist.gov/vuln/detail/CVE-2026-63384
https://nvd.nist.gov/vuln/detail/CVE-2026-63383
Update
Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:
| Platform | Package | Version |
|---|---|---|
| bionic | libevent | 2.1.8-stable-4ubuntu0.1~esm1 |
| Ubuntu 20.04 LTS | libevent | 2.1.11-stable-1ubuntu0.1~esm1 |
| Ubuntu 22.04 LTS | libevent | 2.1.12-stable-1ubuntu0.1 |
| Ubuntu 24.04 LTS | libevent | 2.1.12-stable-9ubuntu2.1 |
| resolute | libevent | 2.1.12-stable-10ubuntu0.1 |
| trusty | libevent | 2.0.21-stable-1ubuntu1.14.04.2+esm1 |
| xenial | libevent | 2.0.21-stable-2ubuntu0.16.04.1+esm1 |