UpHeron
All vulnerabilities

Servers and applications

CVE-2009-1378

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Severity
Medium 5.0
Published
19 May 2009
Last changed
16 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
0.9.8m
Exploit chance
13% in the next 30 daysHigher than 96% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Memory leak (CWE-401)
Attack
Over the network · No login needed
Attacker can
Slow it down
CVSS vector
AV:N/AC:L/Au:N/C:N/I:N/A:P
Sources
NVD

Affected software

SoftwareAffected versions
OpenSSLServers and applications · cpe:a:openssl:openssl
  • After 0.9.8 before 0.9.8m

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2009-1378
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2009-1378