Libevent: Off-by-one stack buffer overflow in dnsname_to_labels via crafted DNS server response

• azl3 fluent-bit 3.1.10-6 on Azure Linux 3.0

• azl3 libevent 2.1.12-1 on Azure Linux 3.0

• azl3 lldpd 1.0.22-1 on Azure Linux 3.0

• azl3 mysql 8.0.46-1 on Azure Linux 3.0

• azl3 ntp 4.2.8p17-2 on Azure Linux 3.0

Separate remediation guidance was not included in the collected bulletin.

SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.

1. Aug 25, 2026 at 8:30 AM UTC
   • Severity changed from High to Medium.
   • Added affected products: azl3 fluent-bit 3.1.10-6 on Azure Linux 3.0, azl3 lldpd 1.0.22-1 on Azure Linux 3.0, azl3 mysql 8.0.46-1 on Azure Linux 3.0, azl3 ntp 4.2.8p17-2 on Azure Linux 3.0.

1. Aug 22, 2026 at 1:03 AM UTC
   Published by Microsoft Security Response Center

   The publication date reported by the vendor.

2. Aug 23, 2026 at 7:50 AM UTC
   Added to SecurityAlert

   We collected the advisory from the official source.

3. Aug 25, 2026 at 1:05 AM UTC
   Updated by Microsoft Security Response Center

   The vendor changed the advisory after it was first published.

4. Oct 28, 2026 at 3:45 AM UTC
   Confirmed at the source

   Our collector saw this advisory during a later source check.