The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle He...
CVE-2014-0160 (GitHub advisory GHSA-w8r8-w5w4-4w4v) is a high-severity vulnerability with a CVSS 3.1 base score of 7.5, classed as Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119). No affected-package or version data has been published, so its fix status is unknown. CISA lists it as a known exploited vulnerability (added 4 May 2022).
Published 7 Apr 2014Updated 22 Oct 2025
- CVE ID
- CVE-2014-0160
- GHSA ID
- GHSA-w8r8-w5w4-4w4v
- EPSS
- 99.99%higher than 99.9% of CVEs
- Weaknesses (CWE)
- KEV status
- Known exploitedAdded 4 May 2022
- Published
- 7 Apr 2014
- Updated
- 22 Oct 2025
- Assigned by (CNA)
- redhat
Summary
Source: GitHub Advisory Database
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Technical details
Source: GitHub Advisory Database
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NHigh7.5Base score from GitHub Advisory Database
- Attack Vector AV
- Network
- Attack Complexity AC
- Low
- Privileges Required PR
- None
- User Interaction UI
- None
- Scope S
- Unchanged
- Confidentiality C
- High
- Integrity I
- None
- Availability A
- None
CISA SSVC decision points
- Exploitation
- active
- Exploited in the wild
- Automatable
- yes
- Attackers can automate this at scale
- Technical impact
- partial
- Limited control of the affected system
CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.
CISA required action
Apply updates per vendor instructions.
Federal agencies must remediate by 25 May 2022.
Affected packages
Source: CVE.org
No affected packages have been published. The vendor may describe affected products only in prose (see the summary).
Fix
Source: CVE.org
Fix status unknown
The sources CVEminer reads publish no affected-package or version data for this vulnerability, so it can't tell whether a fix exists. Check the vendor advisory in the references below.
Vulnerability intelligence
Root cause analysis
Vulnerable functions
References
Fixes 6
- oracle.com/technetwork/topics/security/cpujul2014-1972956.html
- oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html
- lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%…
- lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%…
- lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220…
- lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d…
Advisories 115
Reports and issues 2
Exploits and evidence 1
Other links 12
- download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01
- git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=96db9023b881d7cd9f379b0c154650d6…
- www-01.ibm.com/support/docview.wss?uid=swg21670161
- blackberry.com/btsc/KB35882
- innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf
- websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Vers…
Questions about CVE-2014-0160
- What is the GHSA ID for CVE-2014-0160?
- GitHub tracks CVE-2014-0160 as GHSA-w8r8-w5w4-4w4v.
- What is the CVSS score of CVE-2014-0160?
- CVE-2014-0160 has a CVSS 3.1 base score of 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
- How do I fix CVE-2014-0160?
- No affected-package or version data has been published, so its fix status is unknown.
- Is CVE-2014-0160 exploited in the wild?
- CISA lists it as a known exploited vulnerability (added 4 May 2022). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.99% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.
Data sources
Upstream records
- OSV (GitHub advisory)No record
- GitHub Advisory DatabaseLoadedRaw JSON
- OSV (CVE record)LoadedRaw JSON
- CVE.orgLoaded
- CISA KEV catalogLoaded
Fetched 2 days ago (13 Oct 2026, 13:31 UTC). Records refresh automatically after 24 hours.
Where each part of this page came from
- Title and description
- GitHub Advisory Database
- Severity score
- GitHub Advisory Database
- Weakness (CWE)
- GitHub Advisory Database
- Affected packages
- CVE.org
- Fix
- CVE.org
- References
- Computed by CVEminer
- SSVC
- CVE.org
- KEV status
- CISA KEV catalog
- EPSS
- GitHub Advisory Database
OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.