Every CVE Search/ Get API key

CVE-2014-0160

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle...

7.5 HighIn KEVPublic exploitFix available

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

100.0%Up 3.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Record
CVE-2014-0160
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-125
Updated
2026-11-02
CVE List 7.5

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Record
CVE-2014-0160
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2014-0217 7.5

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Record
EUVD-2014-0217
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-w8r8-w5w4-4w4v 7.5

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle...

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Record
GHSA-w8r8-w5w4-4w4v
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-119, CWE-125
Updated
2026-11-02
CISA KEV No score

OpenSSL Information Disclosure Vulnerability

The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.

Record
CVE-2014-0160
Weakness
CWE-125
Updated
2026-11-02
OSVBELL-CVE-2014-0160 7.5

CVE-2014-0160 does not affect BellSoft software

Record
BELL-CVE-2014-0160
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 15 moreShow less
OSV 7.5

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Record
CVE-2014-0160
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2014-0160 7.5

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Record
DEBIAN-CVE-2014-0160
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2014-0165 No score

Updated openssl package fix two security vulnerabilities

Updated openssl packages fix security vulnerability:

The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack (CVE-2014-0076).

A missing bounds check in the handling of the TLS heartbeat extension in OpenSSL through 1.0.1f can be used to reveal up to 64k of memory to a connected client or server (CVE-2014-0160).

Record
MGASA-2014-0165
Updated
2026-11-02
OSVMGASA-2014-0256 No score

Updated tor packages fix multiple vulnerabilities

Update to version 0.2.4.22 which solves these major and security problems:

  • Block authority signing keys that were used on authorities vulnerable to the "heartbleed" bug in OpenSSL (CVE-2014-0160).

  • Fix a memory leak that could occur if a microdescriptor parse fails during the tokenizing step.

  • The relay ciphersuite list is now generated automatically based on uniform criteria, and includes all OpenSSL ciphersuites with acceptable strength and forward secrecy.

  • Relays now trust themselves to have a better view than clients of which TLS ciphersuites are better than others.

  • Clients now try to advertise the same list of ciphersuites as Firefox 28.

For other changes see the upstream change log

Record
MGASA-2014-0256
Updated
2026-11-02
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10289-1 No score

stunnel-5.38-1.1 on GA media

These are all security issues fixed in the stunnel-5.38-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10289-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10423-1 No score

tor-0.2.8.11-1.1 on GA media

These are all security issues fixed in the tor-0.2.8.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10423-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10528-1 No score

bitcoin-qt5-0.13.1-1.1 on GA media

These are all security issues fixed in the bitcoin-qt5-0.13.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10528-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10529-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10580-1 No score

httrack-3.48.22-1.3 on GA media

These are all security issues fixed in the httrack-3.48.22-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10580-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02
OSVSUSE-RU-2015:0769-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-RU-2015:0769-1
Updated
2026-11-02
OSVSUSE-SU-2015:0546-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:0546-1
Updated
2026-11-02
OSVSUSE-SU-2015:1185-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>
Record
SUSE-SU-2015:1185-1
Updated
2026-11-02

Affected products

Show 16 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
openssl
Debian:12
 before 1.0.1g-1
1.0.1g-1
openssl
Debian:13
 before 1.0.1g-1
1.0.1g-1
openssl
Debian:14
 before 1.0.1g-1
1.0.1g-1
openssl
Debian:7
 before 1.0.1e-2+deb7u5, plus listed versions
1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u4
1.0.1e-2+deb7u5
openssl
Mageia:3
 before 1.0.1e-1.5.mga3
1.0.1e-1.5.mga3
openssl
Mageia:4
 before 1.0.1e-8.2.mga4
1.0.1e-8.2.mga4
tor
Mageia:3
 before 0.2.4.22-1.mga3
0.2.4.22-1.mga3
tor
Mageia:4
 before 0.2.4.22-1.mga4
0.2.4.22-1.mga4
openssl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-debuginfo
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
Show 34 moreShow less
Affected packages
PackageAffectedFixed
openssl-devel
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-perl
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-static
Red Hat:enterprise_linux:6::client
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-debuginfo
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-devel
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-perl
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-static
Red Hat:enterprise_linux:6::computenode
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-devel
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-perl
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-static
Red Hat:enterprise_linux:6::server
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-devel
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-perl
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-static
Red Hat:enterprise_linux:6::workstation
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-debuginfo
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-devel
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-perl
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
openssl-static
Red Hat:storage:2.1:server:el6
 before 0:1.0.1e-16.el6_5.7
0:1.0.1e-16.el6_5.7
rhev-hypervisor6
Red Hat:enterprise_linux:6::hypervisor
 before 0:6.5-20140407.0.el6ev
0:6.5-20140407.0.el6ev
rhev-hypervisor6
Red Hat:enterprise_linux:6::hypervisor
 before 0:6.5-20140118.1.3.2.el6_5
0:6.5-20140118.1.3.2.el6_5
rhevm-spice-client
Red Hat:rhev_manager:3
 before 0:3.3-12.el6_5
0:3.3-12.el6_5
rhevm-spice-client-x64-cab
Red Hat:rhev_manager:3
 before 0:3.3-12.el6_5
0:3.3-12.el6_5
rhevm-spice-client-x64-msi
Red Hat:rhev_manager:3
 before 0:3.3-12.el6_5
0:3.3-12.el6_5
rhevm-spice-client-x86-cab
Red Hat:rhev_manager:3
 before 0:3.3-12.el6_5
0:3.3-12.el6_5
rhevm-spice-client-x86-msi
Red Hat:rhev_manager:3
 before 0:3.3-12.el6_5
0:3.3-12.el6_5
stunnel
openSUSE:Tumbleweed
 before 5.38-1.1
5.38-1.1
tor
openSUSE:Tumbleweed
 before 0.2.8.11-1.1
0.2.8.11-1.1
httrack
openSUSE:Tumbleweed
 before 3.48.22-1.3
3.48.22-1.3
openssl-1_1
openSUSE:Tumbleweed
 before 1.1.1l-1.2
1.1.1l-1.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubFiloSottile/Heartbleed2014-04-07
PoC in GitHubDominikTo/bleed2014-04-08
Exploit-DBOpenSSL TLS Heartbeat Extension - 'Heartbleed' Memory Disclosure2014-04-08
PoC in GitHubLekensteyn/pacemaker2014-04-08
PoC in GitHubcyphar/heartthreader2014-04-08
PoC in GitHubisgroup/openmagic2014-04-08
PoC in GitHubjdauphant/patch-openssl-CVE-2014-01602014-04-08
PoC in GitHubmusalbas/heartbleed-masstest2014-04-08
PoC in GitHubobayesshelton/CVE-2014-0160-Scanner2014-04-08
PoC in GitHubtakeshixx/ssl-heartbleed.nse2014-04-08
Show 21 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubtitanous/heartbleeder2014-04-08
Exploit-DBOpenSSL 1.0.1f TLS Heartbeat Extension - 'Heartbleed' Memory Disclosure (Multiple SSL/TLS Versions)2014-04-09
PoC in GitHubproactiveRISK/heartbleed-extention2014-04-09
PoC in GitHubroganartu/heartbleedchecker-chrome2014-04-09
PoC in GitHubsensepost/heartbleed-poc2014-04-09
PoC in GitHubzouguangxian/heartbleed2014-04-09
PoC in GitHub0x90/CVE-2014-01602014-04-10
Exploit-DBOpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (1)2014-04-10
PoC in GitHubamerine/coronary2014-04-10
PoC in GitHubsammyfung/openssl-heartbleed-fix2014-04-10
PoC in GitHubsiddolo/knockbleed2014-04-10
PoC in GitHubwaqasjamal-zz/HeartBleed-Vulnerability-Checker2014-04-10
PoC in GitHuba0726h77/heartbleed-test2014-04-11
PoC in GitHubpblittle/aws-suture2014-04-11
PoC in GitHub0xinf0/bleeding_onions2014-04-12
PoC in GitHubhreese/heartbleed-dtls2014-04-12
PoC in GitHubGeeksXtreme/ssl-heartbleed.nse2014-04-13
PoC in GitHubidkqh7/heatbleeding2014-04-13
Exploit-DBOpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support)2014-04-24
MetasploitOpenSSL Heartbeat (Heartbleed) Information Leak2014-04-07
MetasploitOpenSSL Heartbeat (Heartbleed) Client Memory Exposure2014-04-07

Plus 50 more. The full list has every link.

History

History
RecordedChangedSources
exploitation
exploits, exploits_more
exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0160 is a high vulnerability (CVSS 7.5) in Openssl, published April 7, 2014. CISA lists it as known to be exploited, since May 4, 2022. EUVD reports exploitation since May 4, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in openssl 1.0.1g-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 698 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open