Servers and applications
CVE-2014-0160
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 4 May 2022.
- Severity
- High 7.5
- Published
- 7 Apr 2014
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 21 Oct 2026
- Fixed in
- 1.0.1g
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
OpenSSLServers and applications · cpe:a:openssl:openssl |
|
Known exploited
- CISA name
- OpenSSL Information Disclosure Vulnerability
- Required action
- Apply updates per vendor instructions.
- Due for US agencies
- 25 May 2022
- Used in ransomware
- Not known