TLP:CLEARKNOWN EXPLOITEDAnalyzedPublished 7 Apr 2014 · Updated 17 Jun 2026
CVE-2014-0160
7.5HighCVSS 3.1
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
- Affected software
- Openssl
- Versions
- Not stated
- Weakness
- CWE-125 · Out-of-bounds read
- Assigned by
- Red Hat
- Known exploited since
- 4 May 2022 (CISA KEV)
- NVD status
- Analyzed
ReferencesNVD https://nvd.nist.gov/vuln/detail/CVE-2014-0160 CVE.org https://www.cve.org/CVERecord?id=CVE-2014-0160 Release Notes http://cogentdatahub.com/ReleaseNotes.htmlRelease Notes http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/Release Notes http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/Release Notes http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/Broken Link http://www.openssl.org/news/secadv_20140407.txt