CVE-2016-4912: The _xrealloc function in xlsp_xmalloc.c in OpenSLP 2.0.0 allows remote attackers to cause a denial of serv...

Security readout for executives and security teams

CVE-2016-4912 is a remote denial-of-service issue in OpenSLP 2.0.0. A remote attacker can crash the service by sending many crafted packets that trigger a memory allocation failure and NULL pointer dereference. The main business risk is service disruption, not data theft or code execution based on the supplied sources. Exposure is most likely where OpenSLP 2.0.0 or downstream packages are installed and reachable over the network. The bundle does not identify specific affected products, distributions, ports, or appliance mappings, so validation requires local package and service inventory. Prioritize exposed OpenSLP deployments that support service discovery or operational infrastructure. This is an availability issue with remote trigger potential, but the supplied evidence does not support active exploitation or critical impact claims. Mitigation focus: Inventory systems for OpenSLP 2.0.0 or vendor-packaged OpenSLP builds.; Review Red Hat, Gentoo, and upstream OpenSLP guidance for fixed packages.; Apply vendor-supported updates where OpenSLP is present..

Prepared

Jun 13, 2026, 05:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.