CVE-2016-10189: BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash...

Security readout for executives and security teams

BitlBee versions before 3.5 can be remotely crashed through a file transfer request involving a contact outside the contact list. The CVE also says arbitrary code execution may be possible, but the provided sources do not prove exploitability beyond denial of service. Exposure is limited to organizations running BitlBee before 3.5, especially where the service can receive untrusted file transfer requests. Most impact is service availability for IRC-to-chat gateway users. Prioritize remediation where BitlBee is internet-facing or supports business communication workflows. The known impact is remote outage, not confirmed compromise, so this is important operational risk rather than a confirmed breach scenario. Mitigation focus: Upgrade BitlBee to version 3.5 or a distribution package containing the vendor fix.; Apply Debian DSA-3853 packages where Debian builds are in use.; Check current BitlBee vendor or distribution guidance for supported fixed versions..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.