# ELSA-2026-67910: Security update for 3 packages

ELSA-2026-67910, released September 16, 2026, fixes 8 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/elsa-2026-67910
- Platform: Linux
- Released: Sep 16, 2026
- Priority: Urgent (Closes CVE-2026-63385, rated Critical)
- CVEs: 8, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://linux.oracle.com/errata/ELSA-2026-67910.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [libevent](https://patchblox.com/security/data/product/linux/libevent.md) | ol 9 | 0:2.1.13-1.el9_8 |
| [libevent-devel](https://patchblox.com/security/data/product/linux/libevent-devel.md) | ol 9 | 0:2.1.13-1.el9_8 |
| [libevent-doc](https://patchblox.com/security/data/product/linux/libevent-doc.md) | ol 9 | 0:2.1.13-1.el9_8 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-63385](https://patchblox.com/security/data/cve/CVE-2026-63385.md) | Urgent | Libevent: HTTP header handling bugs create risk of access control bypass. | 8.6 | 0.0129 |  |
| [CVE-2026-63382](https://patchblox.com/security/data/cve/CVE-2026-63382.md) | High | libevent: Libevent is an event notification library | 8.6 | 0.0078 |  |
| [CVE-2026-63379](https://patchblox.com/security/data/cve/CVE-2026-63379.md) | High | Libevent: HTTP Header smuggling | 8.6 | 0.0071 |  |
| [CVE-2026-63384](https://patchblox.com/security/data/cve/CVE-2026-63384.md) | High | Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value. | 8.6 | 0.0052 |  |
| [CVE-2026-63383](https://patchblox.com/security/data/cve/CVE-2026-63383.md) | High | Libevent: decode_tag_internal() can lead to out-of-bounds read | 8.6 | 0.0049 |  |
| [CVE-2026-63387](https://patchblox.com/security/data/cve/CVE-2026-63387.md) | High | Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response | 8.6 | 0.0042 |  |
| [CVE-2026-63381](https://patchblox.com/security/data/cve/CVE-2026-63381.md) | High | Libevent: Dangling Pointer in `evbuffer_add_buffer_reference` | 8.6 | 0.0016 |  |
| [CVE-2026-63388](https://patchblox.com/security/data/cve/CVE-2026-63388.md) | High | Libevent: Heap out-of-bounds write in bufferevent_socket_set_conn_address_ reachable via AF_UNIX accept | 8.6 | 0.0014 |  |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo