CVE-2014-8176

The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m,...

7.5 HighFix available

The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h frees data structures without considering that application data can arrive between a ChangeCipherSpec message and a Finished message, which allows remote DTLS peers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unexpected application data.

Exploit likelihood

16.6%Up 11.9 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2014-8176
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-8176
Updated: 2026-11-02

EUVDEUVD-2014-8017 No score

Record: EUVD-2014-8017
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qwvg-rfmc-974p No score

The dtls1_clear_queues function in ssl/d1_lib.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m,...

Record: GHSA-qwvg-rfmc-974p
Weakness: CWE-119
Updated: 2026-11-02

OSVRHSA-2015:1115 7.5

Red Hat Security Advisory: openssl security update

Record: RHSA-2015:1115
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV No score

Record: CVE-2014-8176
Updated: 2026-11-02

Show 7 moreShow less

OSVDEBIAN-CVE-2014-8176 No score

Record: DEBIAN-CVE-2014-8176
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10309-1 No score

libcrypto38-2.5.0-1.1 on GA media

These are all security issues fixed in the libcrypto38-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10309-1
Updated: 2026-11-02

OSVSUSE-RU-2015:0769-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-RU-2015:0769-1
Updated: 2026-11-02

OSVSUSE-SU-2015:0546-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:0546-1
Updated: 2026-11-02

OSVSUSE-SU-2015:1185-1 No score

Security update for openssl1

This OpenSSL update fixes the following issues:

* SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Build option no-ssl3 is incomplete (CVE-2014-3568)
* Add support for TLS_FALLBACK_SCSV to mitigate CVE-2014-3566 (POODLE)

Security Issues:

* CVE-2014-3513
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3513>
* CVE-2014-3567
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3567>
* CVE-2014-3566
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3566>
* CVE-2014-3568
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3568>

Record: SUSE-SU-2015:1185-1
Updated: 2026-11-02

OSVUBUNTU-CVE-2014-8176 No score

Record: UBUNTU-CVE-2014-8176
Updated: 2026-11-02

OSVUSN-2639-1 No score

openssl vulnerabilities

Praveen Kariyanahalli, Ivan Fratric and Felix Groebert discovered that OpenSSL incorrectly handled memory when buffering DTLS data. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-8176)

Joseph Barr-Pixton discovered that OpenSSL incorrectly handled malformed ECParameters structures. A remote attacker could use this issue to cause OpenSSL to hang, resulting in a denial of service. (CVE-2015-1788)

Robert Swiecki and Hanno Böck discovered that OpenSSL incorrectly handled certain ASN1_TIME strings. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-1789)

Michal Zalewski discovered that OpenSSL incorrectly handled missing content when parsing ASN.1-encoded PKCS#7 blobs. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-1790)

Emilia Käsper discovered that OpenSSL incorrectly handled NewSessionTicket when being used by a multi-threaded client. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service. (CVE-2015-1791)

Johannes Bauer discovered that OpenSSL incorrectly handled verifying signedData messages using the CMS code. A remote attacker could use this issue to cause OpenSSL to hang, resulting in a denial of service. (CVE-2015-1792)

As a security improvement, this update also modifies OpenSSL behaviour to reject DH key sizes below 768 bits, preventing a possible downgrade attack.

Record: USN-2639-1
Updated: 2026-11-02

Affected products

openssl

Affected packages

Affected packages
Package	Affected	Fixed
`openssl` Debian:12	before 1.0.1h-1	1.0.1h-1
`openssl` Debian:13	before 1.0.1h-1	1.0.1h-1
`openssl` Debian:14	before 1.0.1h-1	1.0.1h-1
`openssl` Debian:6.0 From an advisory covering 6 CVEs	before 0.9.8o-4squeeze21, plus listed versions 0.9.8o-40.9.8o-4squeeze10.9.8o-4squeeze110.9.8o-4squeeze120.9.8o-4squeeze13 Show 15 moreShow less 0.9.8o-4squeeze140.9.8o-4squeeze150.9.8o-4squeeze160.9.8o-4squeeze170.9.8o-4squeeze180.9.8o-4squeeze190.9.8o-4squeeze20.9.8o-4squeeze200.9.8o-4squeeze30.9.8o-4squeeze40.9.8o-4squeeze4~bpo50+10.9.8o-4squeeze50.9.8o-4squeeze70.9.8o-4squeeze80.9.8o-4squeeze9	0.9.8o-4squeeze21
`openssl` Debian:7 From an advisory covering 7 CVEs	before 1.0.1e-2+deb7u17, plus listed versions 1.0.1e-21.0.1e-2+deb7u11.0.1e-2+deb7u101.0.1e-2+deb7u111.0.1e-2+deb7u12 Show 12 moreShow less 1.0.1e-2+deb7u131.0.1e-2+deb7u141.0.1e-2+deb7u151.0.1e-2+deb7u161.0.1e-2+deb7u21.0.1e-2+deb7u31.0.1e-2+deb7u41.0.1e-2+deb7u51.0.1e-2+deb7u61.0.1e-2+deb7u71.0.1e-2+deb7u81.0.1e-2+deb7u9	1.0.1e-2+deb7u17
`openssl` Debian:8 From an advisory covering 7 CVEs	before 1.0.1k-3+deb8u1, plus listed versions 1.0.1k-31.0.1k-3+alpha	1.0.1k-3+deb8u1
`openssl` Red Hat:enterprise_linux:6::client From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-debuginfo` Red Hat:enterprise_linux:6::client From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-devel` Red Hat:enterprise_linux:6::client From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-perl` Red Hat:enterprise_linux:6::client From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11

Show 43 moreShow less

Affected packages
Package	Affected	Fixed
`openssl-static` Red Hat:enterprise_linux:6::client From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl` Red Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-debuginfo` Red Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-devel` Red Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-perl` Red Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-static` Red Hat:enterprise_linux:6::computenode From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl` Red Hat:enterprise_linux:6::server From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-debuginfo` Red Hat:enterprise_linux:6::server From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-devel` Red Hat:enterprise_linux:6::server From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-perl` Red Hat:enterprise_linux:6::server From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-static` Red Hat:enterprise_linux:6::server From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl` Red Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-debuginfo` Red Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-devel` Red Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-perl` Red Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl-static` Red Hat:enterprise_linux:6::workstation From an advisory covering 6 CVEs	before 0:1.0.1e-30.el6_6.11	0:1.0.1e-30.el6_6.11
`openssl` Red Hat:enterprise_linux:7::client From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-libs` Red Hat:enterprise_linux:7::client From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-devel` Red Hat:enterprise_linux:7::client From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-perl` Red Hat:enterprise_linux:7::client From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-static` Red Hat:enterprise_linux:7::client From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl` Red Hat:enterprise_linux:7::computenode From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-debuginfo` Red Hat:enterprise_linux:7::computenode From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-libs` Red Hat:enterprise_linux:7::computenode From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-devel` Red Hat:enterprise_linux:7::computenode From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-perl` Red Hat:enterprise_linux:7::computenode From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-static` Red Hat:enterprise_linux:7::computenode From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl` Red Hat:enterprise_linux:7::server From an advisory covering 6 CVEs	before 1:1.0.1e-42.ael7b_1.8	1:1.0.1e-42.ael7b_1.8
`openssl-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 6 CVEs	before 1:1.0.1e-42.ael7b_1.8	1:1.0.1e-42.ael7b_1.8
`openssl-devel` Red Hat:enterprise_linux:7::server From an advisory covering 6 CVEs	before 1:1.0.1e-42.ael7b_1.8	1:1.0.1e-42.ael7b_1.8
`openssl-libs` Red Hat:enterprise_linux:7::server From an advisory covering 6 CVEs	before 1:1.0.1e-42.ael7b_1.8	1:1.0.1e-42.ael7b_1.8
`openssl-perl` Red Hat:enterprise_linux:7::server From an advisory covering 6 CVEs	before 1:1.0.1e-42.ael7b_1.8	1:1.0.1e-42.ael7b_1.8
`openssl-static` Red Hat:enterprise_linux:7::server From an advisory covering 6 CVEs	before 1:1.0.1e-42.ael7b_1.8	1:1.0.1e-42.ael7b_1.8
`openssl` Red Hat:enterprise_linux:7::workstation From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-devel` Red Hat:enterprise_linux:7::workstation From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-libs` Red Hat:enterprise_linux:7::workstation From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-perl` Red Hat:enterprise_linux:7::workstation From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl-static` Red Hat:enterprise_linux:7::workstation From an advisory covering 6 CVEs	before 1:1.0.1e-42.el7_1.8	1:1.0.1e-42.el7_1.8
`openssl` Ubuntu:14.04:LTS	before 1.0.1f-1ubuntu2.15, plus listed versions 1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4 Show 11 moreShow less 1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.71.0.1f-1ubuntu2.81.0.1f-1ubuntu2.111.0.1f-1ubuntu2.12	1.0.1f-1ubuntu2.15
`openssl` Ubuntu:14.04:LTS From an advisory covering 6 CVEs	before 1.0.1f-1ubuntu2.15, plus listed versions 1.0.1e-3ubuntu11.0.1e-4ubuntu11.0.1e-4ubuntu21.0.1e-4ubuntu31.0.1e-4ubuntu4 Show 11 moreShow less 1.0.1f-1ubuntu11.0.1f-1ubuntu21.0.1f-1ubuntu2.11.0.1f-1ubuntu2.21.0.1f-1ubuntu2.31.0.1f-1ubuntu2.41.0.1f-1ubuntu2.51.0.1f-1ubuntu2.71.0.1f-1ubuntu2.81.0.1f-1ubuntu2.111.0.1f-1ubuntu2.12	1.0.1f-1ubuntu2.15
`libressl` openSUSE:Tumbleweed From an advisory covering 30 CVEs	before 2.5.0-1.1	2.5.0-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-8176 is a high vulnerability (CVSS 7.5) in Openssl, published October 22, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.6%, the 97th percentile. Fixed in openssl 1.0.1h-1.

References

Show 140 moreShow less