The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows…

Description

The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

Scores

EPSS (exploitation in 30 days)

100.0% · top 0.1% of all CVEs (3 Nov 2026)

CISA SSVC

Exploitation: active · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• n/a
• CWE-125 Out-of-bounds Read (opens in a new tab)All about CWE-125 and its CVEs

Affected products

• n/a

  • affected n/a

References (129)

• https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217 (opens in a new tab)x_transferred
• 1030077 (opens in a new tab)vdb-entryx_transferred
• 20140408 heartbleed OpenSSL bug CVE-2014-0160 (opens in a new tab)mailing-listx_transferred
• http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/ (opens in a new tab)x_transferred
• DSA-2896 (opens in a new tab)vendor-advisoryx_transferred
• HPSBGN03008 (opens in a new tab)vendor-advisoryx_transferred
• HPSBMU03024 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2014:0396 (opens in a new tab)vendor-advisoryx_transferred
• HPSBHF03021 (opens in a new tab)vendor-advisoryx_transferred
• HPSBHF03136 (opens in a new tab)vendor-advisoryx_transferred
• VU#720951 (opens in a new tab)third-party-advisoryx_transferred
• http://www.splunk.com/view/SP-CAAAMB3 (opens in a new tab)x_transferred
• HPSBMU03033 (opens in a new tab)vendor-advisoryx_transferred
• http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0 (opens in a new tab)x_transferred
• http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf (opens in a new tab)x_transferred
• HPSBGN03011 (opens in a new tab)vendor-advisoryx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=swg21670161 (opens in a new tab)x_transferred
• http://www.vmware.com/security/advisories/VMSA-2014-0012.html (opens in a new tab)x_transferred
• openSUSE-SU-2014:0492 (opens in a new tab)vendor-advisoryx_transferred
• SSRT101846 (opens in a new tab)vendor-advisoryx_transferred
• 20140409 Re: heartbleed OpenSSL bug CVE-2014-0160 (opens in a new tab)mailing-listx_transferred
• HPSBMU03037 (opens in a new tab)vendor-advisoryx_transferred
• 1030080 (opens in a new tab)vdb-entryx_transferred
• 57836 (opens in a new tab)third-party-advisoryx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=isg400001843 (opens in a new tab)x_transferred
• HPSBMU03012 (opens in a new tab)vendor-advisoryx_transferred
• HPSBST03001 (opens in a new tab)vendor-advisoryx_transferred
• 66690 (opens in a new tab)vdb-entryx_transferred
• http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf (opens in a new tab)x_transferred
• https://filezilla-project.org/versions.php?type=server (opens in a new tab)x_transferred
• HPSBMU03023 (opens in a new tab)vendor-advisoryx_transferred
• 57483 (opens in a new tab)third-party-advisoryx_transferred
• 20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products (opens in a new tab)vendor-advisoryx_transferred
• http://www.kerio.com/support/kerio-control/release-history (opens in a new tab)x_transferred
• http://advisories.mageia.org/MGASA-2014-0165.html (opens in a new tab)x_transferred
• http://www.blackberry.com/btsc/KB35882 (opens in a new tab)x_transferred
• HPSBMU03044 (opens in a new tab)vendor-advisoryx_transferred
• HPSBMU03030 (opens in a new tab)vendor-advisoryx_transferred
• 1030081 (opens in a new tab)vdb-entryx_transferred
• FEDORA-2014-4879 (opens in a new tab)vendor-advisoryx_transferred
• 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (opens in a new tab)mailing-listx_transferred
• FEDORA-2014-4910 (opens in a new tab)vendor-advisoryx_transferred
• https://bugzilla.redhat.com/show_bug.cgi?id=1084875 (opens in a new tab)x_transferred
• FEDORA-2014-9308 (opens in a new tab)vendor-advisoryx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=isg400001841 (opens in a new tab)x_transferred
• HPSBMU03013 (opens in a new tab)vendor-advisoryx_transferred
• 1030079 (opens in a new tab)vdb-entryx_transferred
• RHSA-2014:0377 (opens in a new tab)vendor-advisoryx_transferred
• HPSBMU02995 (opens in a new tab)vendor-advisoryx_transferred
• HPSBPI03031 (opens in a new tab)vendor-advisoryx_transferred
• https://code.google.com/p/mod-spdy/issues/detail?id=85 (opens in a new tab)x_transferred
• HPSBMU02999 (opens in a new tab)vendor-advisoryx_transferred
• HPSBGN03010 (opens in a new tab)vendor-advisoryx_transferred
• HPSBMU03029 (opens in a new tab)vendor-advisoryx_transferred
• http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/ (opens in a new tab)x_transferred
• http://heartbleed.com/ (opens in a new tab)x_transferred
• HPSBMU03018 (opens in a new tab)vendor-advisoryx_transferred
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01 (opens in a new tab)x_transferred
• HPSBMU03040 (opens in a new tab)vendor-advisoryx_transferred
• http://cogentdatahub.com/ReleaseNotes.html (opens in a new tab)x_transferred
• HPSBMU03025 (opens in a new tab)vendor-advisoryx_transferred
• HPSBST03016 (opens in a new tab)vendor-advisoryx_transferred
• HPSBMU03028 (opens in a new tab)vendor-advisoryx_transferred
• HPSBMU03009 (opens in a new tab)vendor-advisoryx_transferred
• http://www.f-secure.com/en/web/labs_global/fsc-2014-1 (opens in a new tab)x_transferred
• TA14-098A (opens in a new tab)third-party-advisoryx_transferred
• 57347 (opens in a new tab)third-party-advisoryx_transferred
• [syslog-ng-announce] 20140411 syslog-ng Premium Edition 5 LTS (5.0.4a) has been released (opens in a new tab)mailing-listx_transferred
• 20140411 MRI Rubies may contain statically linked, vulnerable OpenSSL (opens in a new tab)mailing-listx_transferred
• https://blog.torproject.org/blog/openssl-bug-cve-2014-0160 (opens in a new tab)x_transferred
• http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html (opens in a new tab)x_transferred
• http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html (opens in a new tab)x_transferred
• https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html (opens in a new tab)x_transferred
• http://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=96db9023b881d7cd9f379b0c154650d6c108e9a3 (opens in a new tab)x_transferred
• HPSBST03000 (opens in a new tab)vendor-advisoryx_transferred
• 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (opens in a new tab)mailing-listx_transferred
• HPSBST03004 (opens in a new tab)vendor-advisoryx_transferred
• USN-2165-1 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2014:0378 (opens in a new tab)vendor-advisoryx_transferred
• HPSBMU02997 (opens in a new tab)vendor-advisoryx_transferred
• SUSE-SA:2014:002 (opens in a new tab)vendor-advisoryx_transferred
• 32764 (opens in a new tab)exploitx_transferred
• HPSBMU02994 (opens in a new tab)vendor-advisoryx_transferred
• http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20160512_00 (opens in a new tab)x_transferred
• HPSBMU03022 (opens in a new tab)vendor-advisoryx_transferred
• HPSBST03027 (opens in a new tab)vendor-advisoryx_transferred
• HPSBMU03019 (opens in a new tab)vendor-advisoryx_transferred
• HPSBMU03062 (opens in a new tab)vendor-advisoryx_transferred
• 20140408 Re: heartbleed OpenSSL bug CVE-2014-0160 (opens in a new tab)mailing-listx_transferred
• 1030078 (opens in a new tab)vdb-entryx_transferred
• 59243 (opens in a new tab)third-party-advisoryx_transferred
• http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004661 (opens in a new tab)x_transferred
• HPSBMU03020 (opens in a new tab)vendor-advisoryx_transferred
• HPSBST03015 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2014:0376 (opens in a new tab)vendor-advisoryx_transferred
• HPSBPI03014 (opens in a new tab)vendor-advisoryx_transferred
• MDVSA-2015:062 (opens in a new tab)vendor-advisoryx_transferred
• https://www.cert.fi/en/reports/2014/vulnerability788210.html (opens in a new tab)x_transferred
• 57721 (opens in a new tab)third-party-advisoryx_transferred
• 57968 (opens in a new tab)third-party-advisoryx_transferred
• http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/ (opens in a new tab)x_transferred
• http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=3 (opens in a new tab)x_transferred
• openSUSE-SU-2014:0560 (opens in a new tab)vendor-advisoryx_transferred
• HPSBMU03032 (opens in a new tab)vendor-advisoryx_transferred
• 1030082 (opens in a new tab)vdb-entryx_transferred
• HPSBMU02998 (opens in a new tab)vendor-advisoryx_transferred
• 32745 (opens in a new tab)exploitx_transferred
• 20140412 Re: heartbleed OpenSSL bug CVE-2014-0160 (opens in a new tab)mailing-listx_transferred
• http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/ (opens in a new tab)x_transferred
• HPSBMU03017 (opens in a new tab)vendor-advisoryx_transferred
• https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-17-0008 (opens in a new tab)x_transferred
• http://www.openssl.org/news/secadv_20140407.txt (opens in a new tab)x_transferred
• https://gist.github.com/chapmajs/10473815 (opens in a new tab)x_transferred
• http://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=1 (opens in a new tab)x_transferred
• 1030074 (opens in a new tab)vdb-entryx_transferred
• http://support.citrix.com/article/CTX140605 (opens in a new tab)x_transferred
• 59139 (opens in a new tab)third-party-advisoryx_transferred
• http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/ (opens in a new tab)x_transferred
• 57966 (opens in a new tab)third-party-advisoryx_transferred
• 1030026 (opens in a new tab)vdb-entryx_transferred
• 59347 (opens in a new tab)third-party-advisoryx_transferred
• [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ (opens in a new tab)mailing-listx_transferred
• [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ (opens in a new tab)mailing-listx_transferred
• https://sku11army.blogspot.com/2020/01/heartbleed-hearts-continue-to-bleed.html (opens in a new tab)x_transferred
• [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_transferred
• https://cert-portal.siemens.com/productcert/pdf/ssa-635659.pdf (opens in a new tab)x_transferred
• [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/ (opens in a new tab)mailing-listx_transferred
• https://yunus-shn.medium.com/ricon-industrial-cellular-router-heartbleed-attack-2634221c02bd (opens in a new tab)x_transferred
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0160 (opens in a new tab)government-resource

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• CISA KEV catalog (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2014-0160](https://trackcve.app/badge/CVE-2014-0160.svg)](https://trackcve.app/cve/CVE-2014-0160)

Record last updated 22 Oct 2025, 00:05 UTC.