Live › vulnerability › CVE-2014-0160
Go to dashboardOpenSSL's TLS and DTLS heartbeat handling does not validate lengths, so a remote client can make a server return chunks of its memory. Attackers can read private keys, session data and passwords from the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| OpenSSL OpenSSL | vendor | – | – |
heartbeat fixUpgrade OpenSSL to a fixed release (1.0.1g or later for the 1.0.1 line) and restart services; then rotate TLS private keys, session secrets and passwords that may have been exposed.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
This page as .md · .json · in your agent: get_signal("CVE-2014-0160")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.