Description

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T18:16:37.040Z",
  "pubdate": "2026-08-20T18:16:37.040Z",
  "executiveSummary": "Libevent contains a vulnerability within its WebSocket server implementation where fragmented frames are accumulated without a total message-size limit.\nThe vulnerability type is an unbounded memory allocation leading to Denial of Service via resource exhaustion.\nAffected systems include Libevent versions from 2.2.0-alpha-dev through 2.2.2-alpha.\nThe impact of successful exploitation results in complete memory exhaustion on the host or process, leading to application crashes and service unavailability.\nAttacker capabilities involve unauthenticated remote clients interacting directly with the WebSocket server over the network.\nExploitation requirements include the ability to establish a network connection to the WebSocket service and continuously transmit fragmented frames designed to bypass individual frame size limits while steadily consuming heap memory.",
  "technicalDetails": "The vulnerability resides in the WebSocket server component implemented within ws.c of the Libevent event notification library.\nThe root cause of the vulnerability is the failure to enforce a total accumulated message-size limit when processing fragmented WebSocket frames.\nSpecifically, the implementation continuously stores and aggregates fragmented frames within the evws->incomplete_frames data structure without validating the aggregate size of the incoming multi-frame message.\nThe vulnerable component is the evbuffer subsystem handling WebSocket frame reassembly in the affected versions 2.2.0-alpha-dev up to 2.2.2-alpha.\nNo authentication or specific privileges are required to exploit this flaw, as unauthenticated remote clients can initiate and maintain connections to the service.\nThe attack flow proceeds as follows: An unauthenticated remote client establishes a WebSocket connection with the vulnerable server. The client then repeatedly sends fragmented WebSocket frames where the FIN bit is set to 0, indicating that more fragments are expected to follow.\nEach individual frame is transmitted just below the WS_MAX_RECV_FRAME_SZ threshold to circumvent single-frame size restrictions.\nAs the server receives these frames, it appends them to the evws->incomplete_frames buffer.\nBecause there is no cumulative size enforcement across multiple fragments, the evbuffer grows dynamically and without bound.\nAs the payload behavior repeats continuously, the process consumes all available system memory, ultimately triggering an Out-Of-Memory (OOM) condition.\nPost-exploitation impact is strictly limited to Denial of Service, as the host or process terminates abruptly due to memory exhaustion."
}