Repository navigation
CVE-2026-63381 (Medium) detected in src4.0.4 #497
Description
Activity
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
- changed the title
[-]CVE-2026-63381 (Medium) detected in src4.0.4[/-][+]CVE-2026-63381 (Medium) detected in src4.0.4 - autoclosed[/+]on Sep 18, 2026 ✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
- changed the title
[-]CVE-2026-63381 (Medium) detected in src4.0.4 - autoclosed[/-][+]CVE-2026-63381 (Medium) detected in src4.0.4[/+]on Oct 7, 2026 ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
CVE-2026-63381 - Medium Severity Vulnerability
MidnightBSD OS source code
Library home page: https://github.com/MidnightBSD/src.git
Found in base branches: stable/4.0, master
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Publish Date: 2026-08-20
URL: CVE-2026-63381
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: High
For more information on CVSS3 Scores, click here.Step up your Open Source Security Game with Mend here