CVE-2014-0160

HIGH(7.5)KEVLikely Exploited

OpenSSL Information Disclosure Vulnerability

Description

CVE-2014-0160, widely known as the Heartbleed vulnerability, is a critical information disclosure flaw in the OpenSSL cryptographic library. The vulnerability resides in the TLS and DTLS Heartbeat Extension implementation, where improper bounds checking allows a remote attacker to read up to 64 kilobytes of server memory per request, potentially exposing private encryption keys, user credentials, session tokens, and other sensitive data. Heartbleed affects OpenSSL versions 1.0.1 through 1.0.1f, impacting millions of web servers, network devices, and applications worldwide. CISA has added CVE-2014-0160 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 25, 2022, and the EPSS percentile of approximately 99.997% confirms it is one of the most exploited vulnerabilities in history.

KEV Information

Vendor
OpenSSL
Product
OpenSSL
Date Added
May 4, 2022
Due Date
May 25, 2022
Required Action
Apply updates per vendor instructions.

CVSS Score

Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in Calculator
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6

CWEs

CWE-125Out-of-bounds Read

Out-of-bounds Read

Affected Products

VendorProductVersion
opensslopenssl>= 1.0.1, < 1.0.1g
filezilla-projectfilezilla server< 0.9.44
siemensapplication processing engine firmware2.0
siemenscp 1543-1 firmware1.1
siemenssimatic s7-1500 firmware1.5
siemenssimatic s7-1500t firmware1.5
siemenselan-8.2< 8.3.3
siemenswincc open architecture3.12
intellianv100 firmware1.20; 1.21; 1.24
intellianv60 firmware1.15; 1.25
mitelmicollab6.0; 7.0; 7.1; 7.2; 7.3; 7.3.0.104
mitelmivoice1.1.2.5; 1.1.3.3; 1.2.0.11; 1.3.2.2; 1.4.0.102
opensuseopensuse12.3; 13.1
canonicalubuntu linux12.04; 12.10; 13.10
fedoraprojectfedora19; 20
redhatgluster storage2.1
redhatstorage2.1
redhatvirtualization6.0
redhatenterprise linux desktop6.0
redhatenterprise linux server6.0

Multiple CVSS Assessments

Source: [email protected](Primary)
7.5
HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)
7.5
HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Weakness Type

CWE-125: Out-of-bounds Read

The Heartbleed vulnerability in OpenSSL is an out-of-bounds read that occurs when the TLS Heartbeat Extension handler fails to validate the length field in a heartbeat request message. The OpenSSL implementation reads memory beyond the intended buffer boundary, returning up to 64 KB of adjacent server process memory to the attacker, which can contain cryptographic keys, passwords, and other sensitive information.

Learn more: CWE-125 — Out-of-bounds Read

Impact Analysis

CVE-2014-0160 is remotely exploitable over the network without any authentication or user interaction, making it trivially easy to exploit at scale. The vulnerability only requires sending a malformed Heartbeat request to any TLS-enabled service running a vulnerable version of OpenSSL. Confidentiality (Critical): The primary impact is massive information disclosure, as attackers can repeatedly read 64 KB chunks of server memory, potentially extracting TLS private keys, user passwords, session cookies, and other secrets processed by the server. Integrity: While Heartbleed itself is a read-only vulnerability, stolen private keys enable man-in-the-middle attacks that compromise the integrity of all encrypted communications. Availability: The vulnerability does not directly cause denial of service, but the remediation process (key rotation, certificate reissuance, forced password resets) can be highly disruptive. The EPSS percentile of approximately 99.997% places Heartbleed at the absolute peak of exploitation probability, and its impact on global internet security has been historically unprecedented.

Exploit Maturity

CISA has confirmed active exploitation of CVE-2014-0160 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 25, 2022. The EPSS percentile of approximately 99.997% indicates near-universal exploitation activity, making Heartbleed one of the single most exploited vulnerabilities in internet history. Public exploit tools have been freely available since the day of disclosure, and exploitation requires no specialized skills or custom tooling. Automated scanning tools can identify and exploit vulnerable servers in seconds, and the vulnerability has been actively exploited by both state-sponsored actors and criminal groups since April 2014.

Remediation

  1. Upgrade OpenSSL immediately to version 1.0.1g or later, or apply the Heartbleed patch to your existing OpenSSL installation. As directed by CISA: "Apply updates per vendor instructions." Verify the OpenSSL version on all servers, network devices, and applications that use TLS.

  2. Revoke and reissue all TLS/SSL certificates on servers that ran vulnerable OpenSSL versions, as the private keys may have been compromised. Generate new key pairs before requesting replacement certificates, and ensure old certificates are added to Certificate Revocation Lists (CRLs).

  3. Force password resets for all users whose credentials may have been transmitted through or stored in memory of vulnerable servers. This includes web application passwords, API tokens, session identifiers, and any other authentication material that could have been exposed through the memory leak.

  4. Audit all systems and applications that link against OpenSSL to ensure comprehensive patching. This includes web servers (Apache, Nginx), VPN appliances, email servers, database connectors, and any embedded devices or IoT systems that use OpenSSL for TLS communication.

  5. Implement monitoring for Heartbleed exploitation attempts by deploying IDS/IPS signatures that detect malformed Heartbeat requests. Review server logs and network traffic captures for evidence of past exploitation, and consider engaging an incident response team if exploitation is suspected to have occurred before patching.

Technical Details

CVE-2014-0160 exploits a missing bounds check in OpenSSL's implementation of the TLS Heartbeat Extension (RFC 6520), specifically in the dtls1_process_heartbeat() and tls1_process_heartbeat() functions. When processing a Heartbeat request, the code reads the user-specified payload length from the request but fails to verify that the actual payload matches the declared length, then uses memcpy() to copy the declared number of bytes from the received message buffer into the response. An attacker sends a Heartbeat request with a small payload (as little as 1 byte) but declares a payload length of up to 65,535 bytes, causing OpenSSL to read beyond the message buffer into adjacent process memory and return the contents to the attacker. This out-of-bounds read occurs in the context of the server's TLS process, which typically holds highly sensitive data including private keys, decrypted application data, and user credentials in its heap memory.

Frequently Asked Questions

Is CVE-2014-0160 being actively exploited?

Yes, CVE-2014-0160 (Heartbleed) has been actively exploited since its public disclosure in April 2014. CISA has included it in the Known Exploited Vulnerabilities catalog. The EPSS percentile of approximately 99.997% makes it one of the most exploited vulnerabilities in internet history, with automated tools enabling trivial exploitation.

What products are affected by CVE-2014-0160?

CVE-2014-0160 affects OpenSSL versions 1.0.1 through 1.0.1f. This impacts a vast range of products including web servers (Apache, Nginx), VPN appliances, email servers, network devices, and any application that links against a vulnerable OpenSSL version for TLS support.

How do I fix CVE-2014-0160?

Upgrade OpenSSL to version 1.0.1g or later on all affected systems. After patching, revoke and reissue all TLS certificates as private keys may have been compromised, generate new key pairs, and force password resets for users whose credentials may have been exposed.

How severe is CVE-2014-0160?

CVE-2014-0160 is one of the most severe vulnerabilities ever discovered, with an EPSS percentile of approximately 99.997%. Heartbleed allows unauthenticated remote attackers to silently extract sensitive data from server memory, including private encryption keys and user credentials, with no trace in standard server logs.

CVSS Score

7.5
HIGH(7.5)

EPSS Score

EPSS Score100.00%
EPSS Percentile100.0%

Dates

PublishedApril 7, 2014
Last ModifiedJune 17, 2026
StatusAnalyzed
CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch