CVE-2016-10195: The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecifie...

Security readout for executives and security teams

CVE-2016-10195 is a libevent DNS parsing flaw. A remote attacker could trigger an out-of-bounds stack read in evdns name parsing. The public record says impact is unspecified, so urgency depends on where vulnerable libevent is used and whether DNS input is attacker-influenced. Exposure is most likely in systems or applications using libevent versions before 2.1.6-beta, especially where evdns handles network-supplied DNS data. The bundle does not identify specific downstream products beyond libevent and distribution advisories. Treat this as a dependency hygiene issue with remote-trigger potential, not as confirmed emergency exploitation. Prioritize patch verification on externally reachable systems and platforms relying on older OS packages or bundled libevent. Mitigation focus: Update libevent to 2.1.6-beta or later where upstream versions are managed directly.; Apply patched distribution packages referenced by Debian, Red Hat, Gentoo, or your OS vendor.; Check vendor guidance for any platform-specific mitigation or backported fix status..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.