Libevent: `evtag_unmarshal_header()` decodes a wire `uint32` length into a signed `int` return value.

🔗 CVE IDs covered (1)

🎯 Affected products6

• azl3 fluent-bit 3.1.10-6 on Azure Linux 3.0
• azl3 libevent 2.1.12-1 on Azure Linux 3.0
• azl3 lldpd 1.0.22-1 on Azure Linux 3.0
• azl3 mysql 8.0.46-1 on Azure Linux 3.0
• azl3 ntp 4.2.8p17-2 on Azure Linux 3.0
• azl3 openmpi 4.1.9a1-3 on Azure Linux 3.0

🔗 References (1)

• advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63384