What is "libevent"?

Event notification library

How to use this package

Quick install

Installs the package into the current environment for this session. Use --build or --runtime to persist it as a build-time or runtime dependency.

min add libevent

Declare as a task dependency in minimal.toml

Listing the package under tasks.<name>.packages makes it available inside that task’s sandbox.

[tasks.dev]
packages = ["libevent"]

Build-time vs runtime

Choose build-time for tools needed during compilation, runtime for dynamic libraries loaded at runtime.

min add --build libevent
min add --runtime libevent

Compare versions

to

Dependencies (7)

Dependencies
Name	Version	Kind
base	—	build
glibc	2.44	runtime
make	4.4.1	build
openssl	3.6.5	runtime
pkgconf	3.0.5	build
python CVE:1	3.14.10	build
toolchain	—	build

Dependency changes

Dependants (1)

Dependants
Name	Version
tmux	3.8

Showing 8 advisories

Security advisories for this package
	Status	IDs	Package	Version	Severity	Published
Critical (2)
	Resolved in 2.1.13	GHSA-jcwh-pvf2-73p2 CVE-2026-63385	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	Critical	2 months ago
Summary Libevent: HTTP header handling bugs create risk of access control bypass. Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63385.json, https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2, https://nvd.nist.gov/vuln/detail/CVE-2026-63385 Fix: https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0, https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Resolved in 2.1.13	GHSA-q39v-w2g7-gr8j CVE-2026-63382	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	Critical	2 months ago
Summary libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63382.json, https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j, https://nvd.nist.gov/vuln/detail/CVE-2026-63382 Fix: https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6, https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e, https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660, https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
High (4)
	Status	IDs	Package	Version	Severity	Published
	Resolved in 2.1.13	GHSA-58rx-7448-jw47 CVE-2026-63387	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	High: 7.0	2 months ago
Summary Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63387.json, https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47, https://nvd.nist.gov/vuln/detail/CVE-2026-63387 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Resolved in 2.1.13	GHSA-45c6-qx49-89m8 CVE-2026-63384	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	High	2 months ago
Summary Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value. Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63384.json, https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8, https://nvd.nist.gov/vuln/detail/CVE-2026-63384 Fix: https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda, https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Resolved in 2.1.13	GHSA-fj29-64w6-73h6 CVE-2026-63383	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	High	2 months ago
Summary Libevent: decode_tag_internal() can lead to out-of-bounds read Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63383.json, https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6, https://nvd.nist.gov/vuln/detail/CVE-2026-63383 Fix: https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321, https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Resolved in 2.1.13	GHSA-cvq5-vrvr-j338 CVE-2026-63388	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	High: 8.4	2 months ago
Summary Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63388.json, https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338, https://nvd.nist.gov/vuln/detail/CVE-2026-63388 Fix: https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9, https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
Medium (2)
	Status	IDs	Package	Version	Severity	Published
	Resolved in 2.1.13	GHSA-2gmv-p5m7-98p6 CVE-2026-63379	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	Medium	2 months ago
Summary Libevent: HTTP Header smuggling Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63379.json, https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6, https://nvd.nist.gov/vuln/detail/CVE-2026-63379 Fix: https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636, https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
	Resolved in 2.1.13	GHSA-c2pj-cg4r-88c8 CVE-2026-63381	libevent	2.1.11 – 2.1.12, fixed in 2.1.13	Medium	2 months ago
Summary Libevent: Dangling Pointer in `evbuffer_add_buffer_reference` Affected ranges 2.1.11 – 2.1.12, fixed in 2.1.13 Fixed in 2.1.13 References Advisory: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63381.json, https://github.com/libevent/libevent/security/advisories/GHSA-c2pj-cg4r-88c8, https://nvd.nist.gov/vuln/detail/CVE-2026-63381 Fix: https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c, https://github.com/libevent/libevent/commit/9db091b04f569be3a700fa9860ef02f90b830af9 Web: https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable, https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha
Low (0)
	Status	IDs	Package	Version	Severity	Published
Unknown (0)
	Status	IDs	Package	Version	Severity	Published

Build provenance

For the signed record of what the build used, see the Provenance tab.

46 components

Software Bill of Materials — every package this build depends on
Packages	Version	Repository	License
libeventROOT	2.1.13-stable	github.com/libevent/libevent	BSD-3-Clause
acl	2.4.0	https://storage.googleapis.com/minimal-staging-archives/acl-2.4.0.tar.xzMIRROR	(GPL-2.0-only AND LGPL-2.1-only)
attr	2.6.0	https://storage.googleapis.com/minimal-staging-archives/attr-2.6.0.tar.gzMIRROR	(GPL-2.0-only AND LGPL-2.1-only)
bash	5.3	www.gnu.org/software/bash	GPL-3.0-only
bash-bootstrap	5.3	www.gnu.org/software/bash	GPL-3.0-only
binutils	2.47	www.gnu.org/software/binutils	(GPL-2.0-only AND GPL-3.0-only AND LGPL-2.0-only)
bison	3.8.2	www.gnu.org/software/bison	GPL-3.0-only
bzip2	1.0.8	github.com/libarchive/bzip2	bzip2-1.0.6
coreutils	9.12	www.gnu.org/software/coreutils	GPL-3.0-only
diffutils	3.12	www.gnu.org/software/diffutils	GPL-3.0-only
expat	2.9.0	github.com/libexpat/libexpat	MIT
file	5.48	https://storage.googleapis.com/minimal-staging-archives/file-5.48.tar.gzMIRROR	BSD-2-Clause-Darwin
findutils	4.11.0	www.gnu.org/software/findutils	GPL-3.0-only
flex	2.6.4	github.com/westes/flex	BSD-3-Clause-flex
gawk	5.4.1	www.gnu.org/software/gawk	GPL-3.0-only
gawk-bootstrap	5.4.1	www.gnu.org/software/gawk	GPL-3.0-only
gcc	15.2.0	www.gnu.org/software/gcc	(GPL-2.0-only AND GPL-3.0-only AND LGPL-2.1-only)
gdbm	1.26	www.gnu.org/software/gdbm	GPL-3.0-only
glibc	2.44	www.gnu.org/software/glibc	(GPL-2.0-only AND LGPL-2.1-only)
gmp	6.3.0	www.gnu.org/software/gmp	LGPL-3.0-or-later OR GPL-2.0-or-later
grep	3.12	www.gnu.org/software/grep	GPL-3.0-only
gzip	1.15	www.gnu.org/software/gzip	GPL-3.0-only
libcap	2.78	https://storage.googleapis.com/minimal-staging-archives/libcap-2.78.tar.xzMIRROR	BSD-3-Clause OR GPL-2.0-only
libffi	3.8.0	github.com/libffi/libffi	MIT
linux_headers	6.12.43	github.com/torvalds/linux	GPL-2.0-only WITH Linux-syscall-note
lz4	1.10.0	github.com/lz4/lz4	BSD-2-Clause AND GPL-2.0-or-later
m4	1.4.21	www.gnu.org/software/m4	GPL-3.0-only
make	4.4.1	www.gnu.org/software/make	GPL-3.0-only
mpc	1.4.1	www.gnu.org/software/mpc	LGPL-3.0-or-later
mpfr	4.2.2	www.gnu.org/software/mpfr	GPL-3.0-only
ncurses	6.6	www.gnu.org/software/ncurses	X11-distribute-modifications-variant
openssl	3.6.5	github.com/openssl/openssl	Apache-2.0
patch	2.8.1	www.gnu.org/software/patch	GPL-3.0-only
pcre2	10.49	github.com/PCRE2Project/pcre2	BSD-3-Clause WITH PCRE2-exception
perl	5.44.0	github.com/Perl/perl5	Artistic-1.0-Perl OR GPL-1.0-or-later
pkgconf	3.0.5	github.com/pkgconf/pkgconf	ISC
python	3.14.10	github.com/python/cpython	Python-2.0.1
readline	8.3	www.gnu.org/software/readline	GPL-3.0-only
sed	4.10	www.gnu.org/software/sed	GPL-3.0-only
sqlite	3.54.0	github.com/sqlite/sqlite	blessing
tar	1.35	www.gnu.org/software/tar	GPL-3.0-only
tzdata	2026e	github.com/eggert/tz	LicenseRef-Public-Domain
util-linux	2.42.4	github.com/util-linux/util-linux	GPL-2.0-or-later AND LGPL-2.1-or-later AND BSD-3-Clause
xz	5.8.4	github.com/tukaani-project/xz	(0BSD AND GPL-2.0-only AND GPL-3.0-only AND LGPL-2.1-only)
zlib	1.3.2	github.com/madler/zlib	Zlib
zstd	1.5.7	github.com/facebook/zstd	BSD-3-Clause OR GPL-2.0-only

libevent

Install package

OpenSSF Score

What is "libevent"?

How to use this package

Quick install

Declare as a task dependency in minimal.toml

Build-time vs runtime

Dependencies (7)

Dependency changes

Dependants (1)

Summary

Affected ranges

Fixed in

References

Summary

Affected ranges

Fixed in

References

Summary

Affected ranges

Fixed in

CVSS vector

References

Summary

Affected ranges

Fixed in

References

Summary

Affected ranges

Fixed in

References

Summary

Affected ranges

Fixed in

CVSS vector

References

Summary

Affected ranges

Fixed in

References

Summary

Affected ranges

Fixed in

References

Build provenance

Build provenance

Build provenance

46 components