Every CVE Search/ Get API key

CVE-2009-1378

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in...

5.0 MediumFix available

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Exploit likelihood

12.7%Up 5.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Record
CVE-2009-1378
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-401
Updated
2026-11-02
CVE List No score

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Record
CVE-2009-1378
Updated
2026-11-02
EUVDEUVD-2009-1376 No score

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Record
EUVD-2009-1376
Updated
2026-11-03
GitHub AdvisoriesGHSA-v965-8v6m-8c59 No score

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in...

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Record
GHSA-v965-8v6m-8c59
Weakness
CWE-401
Updated
2026-11-02
OSV No score

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Record
CVE-2009-1378
Updated
2026-11-02
OSVDEBIAN-CVE-2009-1378 No score

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Record
DEBIAN-CVE-2009-1378
Updated
2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:10271-1 No score

libopenssl-devel-1.0.2j-2.2 on GA media

These are all security issues fixed in the libopenssl-devel-1.0.2j-2.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10271-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10529-1 No score

libopenssl1_0_0-steam-1.0.2h-4.1 on GA media

These are all security issues fixed in the libopenssl1_0_0-steam-1.0.2h-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10529-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11127-1 No score

libopenssl-1_1-devel-1.1.1l-1.2 on GA media

These are all security issues fixed in the libopenssl-1_1-devel-1.1.1l-1.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11127-1
Updated
2026-11-02
OSVSUSE-FU-2022:0445-1 No score

Feature update for venv-salt-minion

This feature update for venv-salt-minion provides the following changes:

  • Introduce venv-salt-minion.
  • Mention fixed issues provided with the bundle.
Record
SUSE-FU-2022:0445-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssl
Debian:12
 before 0.9.8k-1
0.9.8k-1
openssl
Debian:13
 before 0.9.8k-1
0.9.8k-1
openssl
Debian:14
 before 0.9.8k-1
0.9.8k-1
openssl
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 7 CVEs
 before 0:0.9.8e-12.el5
0:0.9.8e-12.el5
openssl-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 7 CVEs
 before 0:0.9.8e-12.el5
0:0.9.8e-12.el5
openssl-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 7 CVEs
 before 0:0.9.8e-12.el5
0:0.9.8e-12.el5
openssl
Red Hat:enterprise_linux:5::client
From an advisory covering 7 CVEs
 before 0:0.9.8e-12.el5
0:0.9.8e-12.el5
openssl-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 7 CVEs
 before 0:0.9.8e-12.el5
0:0.9.8e-12.el5
openssl-perl
Red Hat:enterprise_linux:5::client
From an advisory covering 7 CVEs
 before 0:0.9.8e-12.el5
0:0.9.8e-12.el5
openssl
Red Hat:enterprise_linux:5::server
From an advisory covering 7 CVEs
 before 0:0.9.8e-12.el5
0:0.9.8e-12.el5
Show 4 moreShow less
Affected packages
PackageAffectedFixed
openssl-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 7 CVEs
 before 0:0.9.8e-12.el5
0:0.9.8e-12.el5
openssl-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 7 CVEs
 before 0:0.9.8e-12.el5
0:0.9.8e-12.el5
openssl-perl
Red Hat:enterprise_linux:5::server
From an advisory covering 7 CVEs
 before 0:0.9.8e-12.el5
0:0.9.8e-12.el5
openssl-1_1
openSUSE:Tumbleweed
From an advisory covering 136 CVEs
 before 1.1.1l-1.2
1.1.1l-1.2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-1378 is a medium vulnerability (CVSS 5.0) in Openssl, published May 19, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.7%, the 96th percentile. Fixed in openssl 0.9.8k-1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 549 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open