QSN-8710-1: libevent vulnerabilities
2026-09-01

Summary:
Several security issues were fixed in libevent.

Details:
Alexis Challande discovered that libevent incorrectly handled certain
empty output buffers. An attacker could possibly use this issue to
trigger a use-after-free, resulting in a denial of service or arbitrary
code execution. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04
LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
(CVE-2026-63381)

Rajat Raghav discovered that libevent incorrectly handled certain HTTP
requests. An attacker could possibly use this issue to desynchronize
HTTP request boundaries, resulting in HTTP request smuggling.
(CVE-2026-63382)

Qiu Sihao discovered that libevent incorrectly handled certain malformed
tagged RPC data. An attacker could possibly use this issue to trigger an
out-of-bounds read, resulting in a denial of service. (CVE-2026-63383)

Qiu Sihao discovered that libevent incorrectly handled certain large
payload lengths in tagged RPC data. An attacker could possibly use this
issue to consume excessive system resources, resulting in a denial of
service. (CVE-2026-63384)

Asaf Meizner discovered that libevent incorrectly handled certain HTTP
URIs and header values. An attacker could possibly use this issue to
cause HTTP messages to be interpreted inconsistently, resulting in
security restrictions being bypassed. (CVE-2026-63385)

Affected QuantaStor releases:
  6.9.1.001 jammy: libevent-core-2.1-7 2.1.12-stable-1ubuntu0.2 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.9.1.001 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1ubuntu0.2 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.9.0.464 jammy: libevent-core-2.1-7 2.1.12-stable-1ubuntu0.2 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.9.0.464 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1ubuntu0.2 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.6.015 jammy: libevent-core-2.1-7 2.1.12-stable-1ubuntu0.1 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.6.015 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1ubuntu0.1 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.5.018 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.5.018 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.4.038 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.4.038 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.3.018 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.3.018 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.2.002 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.2.002 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.1.007 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.1.007 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.0.205 jammy: libevent-core-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)
  6.8.0.205 jammy: libevent-pthreads-2.1-7 2.1.12-stable-1build3 (fixed in 2.1.12-stable-1ubuntu0.1)

CVEs: CVE-2026-63385, CVE-2026-63381, CVE-2026-63382, CVE-2026-63384, CVE-2026-63383

References:
  https://ubuntu.com/security/notices/USN-8710-1