CVE-2026-63387: 
MySQL vulnerability analysis and mitigation

CVE-2026-63387 is an off-by-one stack buffer overflow vulnerability in libevent's dnsname_to_labels() function within evdns.c. It affects libevent versions prior to 2.1.13 and prior to 2.2.2-alpha (including the 2.2.0-alpha through 2.2.1-alpha range). The flaw allows a crafted DNS server response to trigger a one-byte out-of-bounds null write past the end of a 64 KB stack buffer, potentially crashing or corrupting the affected process. It was disclosed on July 1, 2026, via a GitHub Security Advisory and assigned a CVSS v3.1 base score of 7.0 (High) (GitHub Advisory, Feedly).

The root cause is an off-by-one error (CWE-193) leading to a stack-based buffer overflow (CWE-121) and out-of-bounds write (CWE-787) in dnsname_to_labels() in evdns.c. The function evdns_server_request_format_response() allocates a 64 KB stack buffer (unsigned char buf[1024 * 64]) and calls dnsname_to_labels() when formatting name-bearing DNS records (PTR, CNAME, MX, NS, or SOA). The bounds check uses > instead of >=: if ((size_t)(j + label_len + 1) > buf_len) return -2; — when j + label_len + 1 == buf_len, the check passes, the final label is written, and j equals buf_len. The subsequent null terminator write (buf[j++] = 0) then writes one byte past the end of the stack buffer at buf[buf_len]. Exploitation requires constructing a DNS response where name encoding reaches offset 65534 before a short name (e.g., "x") is encoded in a name-bearing record; a public PoC harness (dns_stack_oob.c) demonstrating the ASAN-detected overflow is referenced in the advisory (GitHub Advisory).

Successful exploitation can cause process termination (crash) or corruption of adjacent stack state, depending on compiler, platform, and stack-protection settings. The primary impact is availability (High), with low confidentiality and integrity impacts due to potential stack corruption. Only applications using libevent's evdns_server_* APIs to generate DNS responses are affected; client-side DNS resolution code is not vulnerable (GitHub Advisory, Feedly).

A proof-of-concept (PoC) exploit harness is publicly referenced in the GitHub Security Advisory, and NVD's SSVC assessment classifies exploitation status as "poc". The vulnerability is not automatable (requires high attack complexity to craft a precisely sized DNS response), and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion as of the time of reporting. The EPSS score is approximately 0.35%, indicating low near-term exploitation probability. The vulnerability was discovered and reported by Michał Majchrowicz and Marcin Wyczechowski of the AFINE Team (credited as @sectroyer) (GitHub Advisory, Feedly).

1. Identify target: Locate applications using libevent's evdns_server_* APIs (i.e., acting as a DNS server using libevent) running versions prior to 2.1.13 or 2.2.2-alpha.
2. Craft filler records: Construct a DNS query that causes the server to build a response containing large filler records, advancing the buffer offset to exactly 65534 bytes within the 64 KB stack buffer.
3. Append name-bearing record: Add a PTR, CNAME, MX, NS, or SOA record with a short target name (e.g., "x") to the response, so that dnsname_to_labels() encodes the final label at offset 65534 and attempts to write the null terminator at buf[65536] (one byte past the buffer end).
4. Send DNS query: Send a UDP DNS query to the target server that triggers construction of this crafted response.
5. Trigger overflow: The off-by-one null write occurs at buf[buf_len], potentially crashing the process or corrupting adjacent stack data, depending on stack layout and compiler protections (GitHub Advisory).

• Process: Unexpected crashes or segmentation faults in applications using libevent's DNS server APIs; core dumps referencing dnsname_to_labels(), evdns_server_request_format_response(), or evdns_server_request_respond() in the stack trace.
• Logs: Application crash logs or system logs (e.g., dmesg, journalctl) showing process termination with signals such as SIGSEGV or SIGABRT originating from the libevent DNS server component.
• Network: Unusual or oversized UDP DNS responses (approaching 64 KB) sent to or from the affected application's DNS server port; repeated DNS queries from a single source crafted to elicit large responses.

Upgrade libevent to version 2.1.13-stable or 2.2.2-alpha, both released on July 1, 2026, which fix the off-by-one bounds check in dnsname_to_labels(). The fix changes the boundary condition to reject cases where writing the final label leaves no room for the terminating null byte (e.g., changing > to >= in the bounds check, or adding a separate pre-write bounds check). As a workaround where upgrading is not immediately possible, restrict network access to the DNS server port of affected applications and avoid exposing libevent-based DNS servers to untrusted networks (GitHub Advisory, Release 2.1.13, Release 2.2.2-alpha).

The vulnerability was picked up by Linux distribution security advisories (e.g., Mageia) and security tracking platforms including Tenable (Nessus plugin 338688), VulDB, and the Yocto Project security mailing list, indicating broad downstream awareness. No notable individual researcher commentary or significant social media discussion beyond standard vulnerability tracking has been identified (Tenable, Feedly).