Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

Bitlbee

First CVE: Sep 4, 2008Active for: 18 yearsTotal CVEs: 6

Bitlbee is a narrowly scoped instant-messaging gateway and relay application that bridges multiple chat protocols into a unified interface, with its vulnerability exposure concentrated in a single product line. Vulnerabilities affecting the vendor skew strongly toward critical severity, reflecting the memory-safety and privilege-management demands inherent in a protocol-translation daemon that handles untrusted network input and manages session privileges; the recurrent weakness classes include NULL-pointer dereferences, use-after-free conditions, and improper privilege-dropping logic. Defenders who deploy Bitlbee as an always-on relay or in shared-access scenarios should treat advisories as priority items; current severity and exploitation counts are shown alongside this summary.

FAUCET AI Generated
6
Total CVEs
More Total CVEs than 86% of tracked vendors
1.0
Avg CVEs / Product / Year
More Avg CVEs / Product / Year than 12% of tracked vendors
8.2
Avg CVSS Score
Higher Avg CVSS Score than 80% of tracked vendors
0.0%
In CISA KEV
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact products developed by Bitlbee over time

Volume of CVEsAvg CVSS Base Score
First CVE
Sep 4, 2008
17 years ago
Most Recent CVE
Oct 29, 2019
2,460 days ago

Products(2 total)

Top CVEs

Signals from CVEs in this vendor scope (6 CVEs).

6 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2012-1187CRITICAL
Bitlbee does not drop extra group privileges correctly in unix.c
Oct 29, 20199.831NONO
CVE-2017-5668CRITICAL
bitlbee-libpurple before 3.5.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer req
Mar 14, 20179.831NONO
CVE-2016-10188CRITICAL
Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote servers to cause a denial of service (crash) or possibly execute arbitrary code by causing a file transfe
Mar 14, 20179.831NONO
CVE-2016-10189HIGH
BitlBee before 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a file transfer request for a c
Mar 14, 20177.526NONO
CVE-2008-3920HIGH
Unspecified vulnerability in BitlBee before 1.2.2 allows remote attackers to "recreate" and "hijack" existing accounts via unspecified vectors.
Sep 4, 20087.520NONO
CVE-2008-3969MEDIUM
Multiple unspecified vulnerabilities in BitlBee before 1.2.3 allow remote attackers to "overwrite" and "hijack" existing accounts via unknown vectors related to "inconsistent handl
Sep 11, 20085.018NONO
View all 6 CVEs →

CVE Severity & Scoring

Severity distribution of CVEs that affect this vendor's products6 CVEs
17%
33%
50%
Severity distribution among all CVEs352,294 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network4 (66.7%)
Unknown2 (33.3%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low4 (66.7%)
High0 (0.0%)
Unknown2 (33.3%)
User Interaction
None4 (66.7%)
Unknown2 (33.3%)
Required0 (0.0%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None4 (66.7%)
Unknown2 (33.3%)

Exploit Exposure

Signals from CVEs in this vendor scope (6 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

An overview of all social media posts that mention a CVE ID that affects a product developed by Bitlbee.

Media Mentions

Media articles that mention a CVE ID that affects a product developed by Bitlbee — matched by CVE ID, not by vendor name.

Top CNAs Publishing CVEs For Bitlbee's Products

View all 2 CNAs →

Top CWEs