The vulnerability arises from the libevent WebSocket server’s handling of fragmented frames. In versions 2.2.0‑alpha‑dev through 2.2.2‑alpha, fragmented frames are accumulated in an internal list without imposing a total message‑size restriction. An unauthenticated remote client can persistently send small fragments with the FIN flag cleared, causing the internal buffer to grow without bound until the process or host runs out of memory, resulting in a crash or unresponsive state.

The issue affects the libevent event notification library, specifically the WebSocket server component in the libevent:libevent product. Any deployment using libevent versions 2.2.0‑alpha‑dev, 2.2.0‑alpha, and up through 2.2.2‑alpha is vulnerable; later releases such as 2.2.2‑alpha onward contain the fix.

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the attack vector is clear: a remote, unauthenticated client can trigger the exploit by establishing a WebSocket connection and sending repeated fragmented frames. Because authentication is not required, any host on the same network that can reach the service could potentially initiate the attack, leading to service disruption through memory exhaustion.