{"id":"CVE-2009-4355","aliases":["DEBIAN-CVE-2009-4355","DSA-1970-1","EUVD-2009-4323","GHSA-cg3r-vf2p-3f9h","RHSA-2010:0054"],"status":"published","title":"Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and...","description":"Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.09184,"percentile":0.95361,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2010-01-13T00:00:00Z","modified":"2026-10-23T17:47:41Z","fixes":[{"ecosystem":"Debian:12","package":"openssl","fixed_in":["0.9.8k-8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"openssl","fixed_in":["0.9.8k-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"openssl","fixed_in":["0.9.8k-8"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"openssl","fixed_in":["0.9.8g-15+lenny6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8k-8"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8k-8"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8k-8"}]}]},{"source":"osv","ecosystem":"Debian:5.0","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.8g-15+lenny6"}]}],"versions":["0.9.8g-15","0.9.8g-15+lenny1","0.9.8g-15+lenny3","0.9.8g-15+lenny5"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8e-12.el5_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8e-12.el5_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8e-12.el5_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8e-12.el5_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8e-12.el5_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8e-12.el5_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8e-12.el5_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8e-12.el5_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8e-12.el5_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.9.8e-12.el5_4.1"}]}],"bundled":2}],"products":[{"vendor":"openssl","product":"openssl"},{"vendor":"redhat","product":"openssl"}],"references":[{"url":"http://www.debian.org/security/2010/dsa-1970","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/0916","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://cvs.openssl.org/chngview?cn=19167","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/42724","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/39461","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11260","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=546707","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2010\u0026m=slackware-security.663049","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred","web"]},{"url":"http://secunia.com/advisories/38761","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0004","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/38181","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/38200","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://issues.rpath.com/browse/RPL-3157","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2010/0839","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://cvs.openssl.org/chngview?cn=19069","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://marc.info/?l=bugtraq\u0026m=127128920008563\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"http://cvs.openssl.org/chngview?cn=19068","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:022","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2010-0095.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-884-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2010/01/13/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://kb.bluecoat.com/index?page=content\u0026id=SA50","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6678","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://secunia.com/advisories/42733","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2010/0124","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038587.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://secunia.com/advisories/38175","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12168","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4355","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cg3r-vf2p-3f9h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-4355","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2010:0054","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=510197","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0054.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2409","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-4355","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-4355","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2009-4355","description":"Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.","status":"published","published":"2010-01-14T19:00:00Z","modified":"2024-08-07T07:01:19.955Z","updated_at":"2026-11-02T14:33:24.782697Z"}],"euvd":[{"id":"EUVD-2009-4323","description":"Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.","status":"published","published":"2010-01-14T19:00:00Z","modified":"2024-08-07T07:01:19Z","updated_at":"2026-11-03T01:39:10.681785Z"}],"ghsa":[{"id":"GHSA-cg3r-vf2p-3f9h","title":"Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and...","description":"Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.","status":"published","published":"2022-05-02T03:53:58Z","modified":"2023-01-31T05:09:05Z","updated_at":"2026-11-02T14:49:29.017576Z"}],"nvd":[{"id":"CVE-2009-4355","description":"Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.","status":"published","published":"2010-01-14T19:30:00.39Z","modified":"2026-06-16T23:13:30.543Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:01:38.33745Z"}],"osv":[{"id":"CVE-2009-4355","description":"Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.","status":"published","published":"2010-01-14T19:30:00Z","modified":"2026-04-10T03:40:59.53659Z","updated_at":"2026-11-02T15:43:57.714116Z"},{"id":"DEBIAN-CVE-2009-4355","description":"Memory leak in the zlib_stateful_finish function in crypto/comp/c_zlib.c in OpenSSL 0.9.8l and earlier and 1.0.0 Beta through Beta 4 allows remote attackers to cause a denial of service (memory consumption) via vectors that trigger incorrect calls to the CRYPTO_cleanup_all_ex_data function, as demonstrated by use of SSLv3 and PHP with the Apache HTTP Server, a related issue to CVE-2008-1678.","status":"published","published":"2010-01-14T19:30:00.39Z","modified":"2026-10-23T17:47:41.081077133Z","updated_at":"2026-11-02T15:45:24.013654Z"},{"id":"DSA-1970-1","title":"openssl - denial of service","status":"published","published":"2010-01-13T00:00:00Z","modified":"2026-03-09T01:21:19.554494Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"RHSA-2010:0054","title":"Red Hat Security Advisory: openssl security update","status":"published","published":"2024-09-15T18:16:24Z","modified":"2026-06-29T10:02:57Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}