Repository navigation
CVE-2026-63381 (Medium) detected in src4.0.4 #497
Description
CVE-2026-63381 - Medium Severity Vulnerability
Vulnerable Library - src4.0.4
MidnightBSD OS source code
Library home page: https://github.com/MidnightBSD/src.git
Found in base branches: stable/4.0, master
Vulnerable Source Files (1)
Vulnerability Details
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty chain without resetting outbuf->first, outbuf->last, or outbuf->last_with_datap, and APPEND_CHAIN_MULTICAST subsequently dereferences the dangling chain pointer. A caller that can drive this buffer state can cause memory corruption or a process crash. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.
Publish Date: 2026-08-20
URL: CVE-2026-63381
CVSS 3 Score Details (6.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: High
Step up your Open Source Security Game with Mend here
Activity
mend-bolt-for-github commentedon Sep 18, 2026
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
[-]CVE-2026-63381 (Medium) detected in src4.0.4[/-][+]CVE-2026-63381 (Medium) detected in src4.0.4 - autoclosed[/+]mend-bolt-for-github commentedon Sep 18, 2026
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
[-]CVE-2026-63381 (Medium) detected in src4.0.4 - autoclosed[/-][+]CVE-2026-63381 (Medium) detected in src4.0.4[/+]mend-bolt-for-github commentedon Oct 7, 2026
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.