CVE-2026-63383: 
MySQL vulnerability analysis and mitigation

CVE-2026-63383 is an out-of-bounds read vulnerability in libevent's decode_tag_internal() function within event_tagging.c, which can be triggered by a remote attacker sending malformed tagged RPC data to crash the affected process. It affects libevent versions prior to 2.1.13 and prior to 2.2.2-alpha (including the 2.2.0-alpha and 2.2.1-alpha releases). The vulnerability was reported by researcher @Brubbish, disclosed via GitHub Security Advisory GHSA-fj29-64w6-73h6 on July 1, 2026, and published to NVD on August 20, 2026. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause (CWE-125: Out-of-bounds Read) lies in a mismatch between the contiguous memory window guaranteed by evbuffer_pullup() and the loop bound used in decode_tag_internal(). The function calls evbuffer_pullup() requesting at most sizeof(ev_uint32_t)+1 (5) contiguous bytes, but the iteration loop uses the full logical buffer length (len) as its bound. When an evbuffer is fragmented — for example, split into a 5-byte first chunk and a 1-byte second chunk — a 6-byte malformed tag (e.g., 80 80 80 80 80 00) causes the data++ pointer to advance past the contiguous pullup window, triggering a heap-buffer-overflow read. The vulnerable code path is reachable via evtag_unmarshal_header() and potentially via higher-level evrpc request parsing at evrpc.c:361. The fix, applied in commits 91ed874 and e1f9e21, stores the pullup length in a variable and bounds the loop by pullup_len instead of len (GitHub Advisory, Fix Commit 2.1.x, Fix Commit 2.2.x).

Successful exploitation causes an out-of-bounds heap read that crashes the process decoding attacker-controlled tagged RPC data, resulting in a Denial of Service (DoS). Both evrpc clients and servers using libevent are affected when they process untrusted RPC input. There is no confirmed confidentiality or integrity impact — the primary consequence is availability loss through process termination (GitHub Advisory, Feedly).

NVD's SSVC assessment classifies this vulnerability as having a proof-of-concept (PoC) available and as automatable, meaning it can be exploited without user interaction across the network. The PoC harness (evtag_header_harness.c) and minimal malformed payload (80 80 80 80 80 00) are documented in the public GitHub Security Advisory. The EPSS score is approximately 0.38%, indicating a relatively low (but non-negligible) probability of exploitation in the wild in the near term. There is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory, Feedly).

1. Identify target: Locate services that use libevent versions prior to 2.1.13 or 2.2.2-alpha and expose evrpc endpoints over the network (e.g., using Shodan, Censys, or banner grabbing).
2. Craft malformed payload: Construct a 6-byte malformed tag payload: 80 80 80 80 80 00. This is the minimal tag with more than 5 continuation bytes, designed to exceed the evbuffer_pullup() contiguous window.
3. Fragment the evbuffer: Deliver the payload in a fragmented manner — split into a 5-byte first segment and a 1-byte second segment — so that the evbuffer is not contiguous and the pullup window covers only the first 5 bytes.
4. Send to evrpc endpoint: Transmit the crafted fragmented RPC data to the target service's evrpc listener. The data is processed through evtag_unmarshal_header() → decode_tag_internal().
5. Trigger out-of-bounds read: The loop in decode_tag_internal() iterates using the full logical buffer length, advancing the data pointer past the 5-byte contiguous pullup window into unallocated memory, triggering a heap-buffer-overflow read and crashing the process (GitHub Advisory).

• Network: Repeated network connections to evrpc service ports delivering short (6-byte) malformed payloads; unusual fragmented TCP segments targeting libevent-based RPC services.
• Logs: Application crash logs or core dumps referencing decode_tag_internal in event_tagging.c; ASan/UBSan output mentioning heap-buffer-overflow at event_tagging.c:219 if the service is compiled with sanitizers.
• Process: Unexpected process termination or restart of libevent-based services (e.g., via systemd restart logs or supervisor alerts); crash reports with stack traces showing decode_tag_internal → evtag_unmarshal_header call chains.
• File System: Core dump files generated by the affected process in the working directory or /var/crash/ (GitHub Advisory).

Upgrade libevent to version 2.1.13-stable or 2.2.2-alpha (or later), which contain the fix bounding the decode_tag_internal() loop by the actual contiguous pullup length. If immediate patching is not feasible, implement network-level filtering to block untrusted RPC traffic from reaching libevent-based services, or run affected services in isolated environments (e.g., containers or VMs) to limit the blast radius of a process crash. Downstream distributions such as Ubuntu have issued security notices (USN-8710-1) with updated packages (libevent 2.1.13 Release, libevent 2.2.2 Release, Ubuntu Advisory).

The libevent maintainer (nmathewson) published the fix and advisory on July 1, 2026, as part of a broader security release (2.1.13-stable) that addressed multiple vulnerabilities across evbuffer, evhttp, evdns, and evrpc modules. The Yocto Project security mailing list flagged the issue for embedded Linux users. Ubuntu issued security notice USN-8710-1 and Mageia issued advisory MGASA-2026-0294 to address the vulnerability in their respective distributions (libevent 2.1.13 Release, Ubuntu Advisory).