A denial-of-service vulnerability exists in the libevent event notification library affecting versions 2.2.0-alpha-dev through 2.2.2-alpha. The WebSocket server implementation in ws.c fails to enforce a total message-size limit when accumulating fragmented frames in evws->incomplete_frames. An unauthenticated remote attacker can exploit this by repeatedly sending fragmented WebSocket frames below the WS_MAX_RECV_FRAME_SZ threshold with FIN=0, causing the evbuffer to grow indefinitely. This unbounded memory growth can exhaust process or host memory, resulting in a denial-of-service condition. No authentication is required to trigger the vulnerability, making it trivially exploitable from any remote client. The issue has been patched in libevent version 2.2.2-alpha, with a corresponding commit and security advisory published on GitHub.
