Libevent · Libevent · CVE-2015-6525
**Name of the Vulnerable Software and Affected Versions**
Libevent versions 2.0.x through 2.0.21
Libevent versions 2.1.x through 2.1.4-beta
**Description**
The issue is caused by multiple integer overflows in the evbuffer API, which can lead to a heap-based buffer overflow or an infinite loop when "insanely large inputs" are provided to certain functions, including `evbuffer add`, `evbuffer prepend`, `evbuffer expand`, `exbuffer reserve space`, or `evbuffer read`. This can allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact.
**Recommendations**
For Libevent versions 2.0.x through 2.0.21, update to version 2.0.22 or later.
For Libevent versions 2.1.x through 2.1.4-beta, update to version 2.1.5-beta or later.
As a temporary workaround, consider restricting the input size to the `evbuffer add`, `evbuffer prepend`, `evbuffer expand`, `exbuffer reserve space`, and `evbuffer read` functions to prevent "insanely large inputs" from being processed.