{"action":"Upgrade libevent to 2.0.21-stable-3 or later.","affected":[{"fixed":"2.0.21-stable-3","introduced":"0"}],"component":"libevent","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["2.0.21-stable-3"],"id":"tcs_01M5NBEEX64NTQWSQM3MWRZH3H","modified_at":"2026-09-22T07:02:53.095258300Z","published_at":"2017-03-15T15:59:00.390Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2016-10195","https://security-tracker.debian.org/tracker/CVE-2016-10195"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2016-10195","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2016-10195"}],"summary":"The name_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving the label_len variable, which triggers an out-of-bounds stack"}