Evvtag_unmarshal_header incorrectly converts an attacker‑controlled unsigned 32‑bit length into a signed integer. When the value exceeds the maximum signed 32‑bit integer, the conversion produces a negative or truncated result. The downstream function evtag_unmarshal_string then uses this value to size a memory allocation, leading to an oversized or wrapped request that can cause a buffer allocation failure and crash the application. The weakness is a classic integer overflow/underflow vulnerability (CWE‑190).

The vulnerability affects the libevent library, specifically all releases prior to 2.1.13 stable and 2.2.2‑alpha. Systems that embed older libevent versions and accept externally supplied tags are at risk.

The CVSS score of 8.7 indicates high severity. EPSS is not available, and KEV does not list this issue. The likely attack vector is remote, where an attacker sends a crafted event tag payload over a network interface that the libevent process consumes. The impact is limited to denial of service on the vulnerable process, but repeated exploitation could interrupt critical network services.