VYPR
← All advisories
Unrated severityNVD Advisory· Published Aug 24, 2015· Updated May 6, 2026

CVE-2015-6525

CVE-2015-6525

Description

Integer overflows in Libevent evbuffer API (CVE-2015-6525) allow DoS or possibly more via heap overflow or infinite loop on large inputs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Integer overflows in Libevent evbuffer API (CVE-2015-6525) allow DoS or possibly more via heap overflow or infinite loop on large inputs.

Vulnerability

CVE-2015-6525 describes multiple integer overflow vulnerabilities in the evbuffer API of Libevent versions 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta. The flaws exist in the evbuffer_add, evbuffer_prepend, evbuffer_expand, evbuffer_reserve_space, and evbuffer_read functions. Processing "insanely large inputs" can trigger integer overflows, leading to either a heap-based buffer overflow or an infinite loop [1].

Exploitation

An attacker must provide inputs large enough to cause an integer overflow in one of the affected evbuffer functions. The attack surface depends on the application; for example, programs using the evbuffer API (including bufferevent_, evhttp_, or evrpc_ functions) could be targeted by sending oversized data over a network or through other input channels. No authentication is required if the application exposes the vulnerable API to untrusted data [1].

Impact

Successful exploitation can cause a denial of service (DoS) via an infinite loop or crash. The discovery report also notes that heap-based buffer overflows may be possible, which could potentially lead to arbitrary code execution depending on the environment and application hardening, though the primary and confirmed impact is denial of service [1].

Mitigation

Users should upgrade to Libevent 2.0.22 or 2.1.5-beta (or later releases in the 2.1.x series) which include fixes for these integer overflows. No workaround is available if the evbuffer API is used. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities Catalog [1].

References
  1. [Libevent-users] Advisory: integer overflow in evbuffers for Libevent <= 1.4.14b,2.0.21,2.1.4-alpha [CVE-2014-6272]

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

27
  • Libevent Project/Libevent26 versions
    cpe:2.3:a:libevent_project:libevent:2.0.1:*:*:*:*:*:*:*+ 25 more
    • cpe:2.3:a:libevent_project:libevent:2.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.14:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.15:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.16:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.17:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.18:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.19:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.20:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.21:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.0.9:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:libevent_project:libevent:2.1.4:*:*:*:*:*:*:*
    • (no CPE)range: <2.0.22, <2.1.5-beta
  • Debian/Debian Linux
    cpe:2.3:o:debian:debian_linux:7.1:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.