A null pointer dereference is triggered in libevent’s evws_new_session when the error path is entered after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. The routine then unconditionally removes a session from a list that was never inserted, causing the process to crash. This results in a denial‑of‑service condition. The underlying weaknesses are a null pointer dereference (CWE‑476) and an improper use of freed memory (CWE‑416).

All libevent releases prior to 2.2.2-alpha are affected. This includes any system or application that has linked against libevent before the 2.2.2-alpha release and has not upgraded to a later, patched version.

The CVSS score is 5.7, indicating moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local caller or an application that can induce a failure in bufferevent_enable_locking_. An attacker who can trigger this failure path can crash the process, causing a denial of service. Because the exploit relies on a specific failure condition, the likelihood of widespread accidental exploitation is low, but a determined attacker with sufficient access could still trigger the crash.