---
id: "CVE-2014-0160"
kind: "vulnerability"
aliases: ["CVE-2014-0160"]
title: "OpenSSL OpenSSL: OpenSSL Information Disclosure Vulnerability"
severity: "high"
cvss: 7.5
epss: 0.99999
exploited: true
status: "open"
category: "package"
products: [{"name": "OpenSSL OpenSSL", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "linux", "openssl", "package", "self-hosted", "tls-servers"]
not_affected_if: ["heartbeat-disabled", "managed-hosting", "openssl-below-1.0.1"]
published_at: "2014-04-07T22:55:03+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0160", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2014-0160", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0160", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# OpenSSL OpenSSL: OpenSSL Information Disclosure Vulnerability

OpenSSL's TLS and DTLS heartbeat handling does not validate lengths, so a remote client can make a server return chunks of its memory. Attackers can read private keys, session data and passwords from the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:OpenSSL OpenSSL affected ? fixed ?

## How to check

Run openssl version and compare against the fixed releases; on Linux, check package changelogs for the 'heartbeat' fix. Scan exposed TLS services with a Heartbleed test tool.

## Fix

Upgrade OpenSSL to a fixed release (1.0.1g or later for the 1.0.1 line) and restart services; then rotate TLS private keys, session secrets and passwords that may have been exposed.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-0160
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2014-0160
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2014-0160

## From the sources

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_