CVE-2026-63384: 
MySQL vulnerability analysis and mitigation

CVE-2026-63384 is an integer overflow vulnerability in libevent's event tag unmarshalling code that can cause a denial of service. It affects all libevent versions prior to 2.1.13 (stable branch) and prior to 2.2.2-alpha (development branch), specifically versions up to and including 2.1.12 and 2.2.1-alpha. The vulnerability was discovered by researcher @Brubbish, disclosed via GitHub Security Advisory GHSA-45c6-qx49-89m8 on July 1, 2026, and published to NVD on August 20, 2026. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly).

The root cause is an incorrect integer conversion (CWE-190: Integer Overflow or Wraparound) in event_tagging.c. The function evtag_unmarshal_header() calls evtag_decode_int() to decode an attacker-controlled wire uint32 payload length, but returns the result as a signed int. Any value in the range 0x80000000–0xFFFFFFFE (i.e., above INT_MAX) becomes negative or truncated upon conversion. A confirmed downstream consumer, evtag_unmarshal_string(), then uses this corrupted signed value in allocation sizing, resulting in a wrapped enormous allocation request (e.g., 0xffffffff80000001 bytes) that causes the process to abort or fail with ENOMEM. The vulnerability is reachable via the public API through evtag_unmarshal_header() → evtag_unmarshal_string(), and a proof-of-concept harness using ASan/UBSan was included in the advisory (GitHub Advisory, Fix Commit).

Successful exploitation results in a denial-of-service condition affecting any application that uses libevent's evtag/evrpc subsystem to process untrusted network data. An unauthenticated remote attacker can send a single crafted event tag payload with a length field above INT_MAX to trigger the oversized allocation request, crashing the libevent-based service. There is no confirmed confidentiality or integrity impact — the vulnerability is limited to availability — but any service relying on libevent for event-driven networking (e.g., Tor, Memcached, or custom evrpc applications) could be rendered unavailable (GitHub Advisory, Feedly).

NVD's SSVC assessment classifies this vulnerability as having a PoC available and being automatable, though Feedly's executive summary notes no confirmed public proof-of-concept exploit or active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.38%, indicating a low near-term exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly, GitHub Advisory).

1. Identify target: Locate a network-accessible service that uses libevent's evtag/evrpc API to process untrusted input and runs a vulnerable version (libevent < 2.1.13 or 2.2.0-alpha to < 2.2.2-alpha).
2. Craft malicious payload: Construct an event tag wire message with a payload length field set to a value above INT_MAX (e.g., 0x80000000 = 2,147,483,648). The encoded header for tag 1 with this length is: 01 70 00 00 00 80 (6 bytes).
3. Send the payload: Transmit the crafted message to the target service over the network. No authentication is required.
4. Trigger integer overflow: The server's evtag_unmarshal_header() decodes the uint32 length and returns it as a signed int, producing a negative value (e.g., -2147483648).
5. Cause denial of service: evtag_unmarshal_string() uses the negative/truncated value in a malloc() call, requesting an impossibly large allocation (e.g., 0xffffffff80000001 bytes), causing the process to abort or return ENOMEM and fail, effectively crashing or disabling the service (GitHub Advisory).

• Network: Unexpected or malformed event tag messages sent to services using libevent's evrpc interface; network packets containing a 6-byte header pattern 01 70 00 00 00 80 or similar with high-byte length fields (MSB set in the 4-byte length field).
• Logs: Application crash logs or core dumps from libevent-based services; log entries indicating malloc: Cannot allocate memory or allocation failure in evtag_unmarshal_string; ASan/UBSan output referencing event_tagging.c:572 if the binary was compiled with sanitizers.
• Process: Unexpected termination or restart of libevent-based daemons (e.g., Tor, Memcached, custom evrpc services); process crash with signal SIGABRT originating from the memory allocator.

Upgrade libevent to version 2.1.13-stable (stable branch) or 2.2.2-alpha (development branch), both released on July 1, 2026, which fix this issue by rejecting any payload length above INT_MAX before the signed conversion occurs. The fix adds a single bounds check: if (evtag_decode_int(&len, evbuf) == -1 || len > INT_MAX) return (-1);. For systems that cannot be patched immediately, implement network-level controls (firewalls, ACLs) to restrict untrusted access to services using vulnerable libevent versions. Linux distributions including Ubuntu (USN-8710-1) and Mageia have issued updated packages (libevent 2.1.13 Release, libevent 2.2.2 Release, Fix Commit).

The vulnerability was reported by security researcher @Brubbish and coordinated through GitHub's private vulnerability reporting process, with the advisory published by libevent maintainer @nmathewson. Ubuntu issued security notice USN-8710-1 and Mageia issued advisory MGASA-2026-0294 to address the issue in their respective package repositories. The Yocto Project security mailing list also flagged the vulnerability for embedded Linux users. No significant broader media coverage or notable social media discussion has been identified beyond standard distribution security channels (GitHub Advisory, Ubuntu Advisory).