Description
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.1g-1 | — |
| Debian 13 | openssl | 1.0.1g-1 | — |
| Debian 12 | openssl | 1.0.1g-1 | — |
| Debian 7 | openssl | 1.0.1e-2+deb7u5 | DSA-2896-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | openssl +3 | 1.0.1e-16.el6_5.7 | RHSA-2014:0376 |
| RHEL 6 | rhev-hypervisor6 | 6.5-20140118.1.3.2.el6_5 | RHSA-2014:0396, RHSA-2014:0378 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | rhevm-spice-client +4 | 3.3-12.el6_5 | RHSA-2014:0416 |
| Red Hat Gluster Storage 2 | openssl +3 | 1.0.1e-16.el6_5.7 | RHSA-2014:0377 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | httrack | 3.48.22-1.3 | openSUSE-SU-2024:10580-1 |
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
| openSUSE Tumbleweed | stunnel | 5.38-1.1 | openSUSE-SU-2024:10289-1 |
| openSUSE Tumbleweed | tor | 0.2.8.11-1.1 | openSUSE-SU-2024:10423-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
OpenSSL Heartbeat (Heartbleed) Information Leak
auxiliary/scanner/ssl/openssl_heartbleed
-
OpenSSL Heartbeat (Heartbleed) Client Memory Exposure
auxiliary/server/openssl_heartbeat_client_memory
Exploit-DB 4
- OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (2) (DTLS Support) EDB-32998 · remote · Apr 24, 2014 · verified
- OpenSSL TLS Heartbeat Extension - 'Heartbleed' Information Leak (1) EDB-32791 · remote · Apr 10, 2014 · verified
- OpenSSL 1.0.1f TLS Heartbeat Extension - 'Heartbleed' Memory Disclosure (Multiple SSL/TLS Versions) EDB-32764 · remote · Apr 9, 2014 · verified
- OpenSSL TLS Heartbeat Extension - 'Heartbleed' Memory Disclosure EDB-32745 · remote · Apr 8, 2014 · verified
GitHub 76 repositories · most starred shown
-
FiloSottile/Heartbleed ★ 2,369 · Apr 7, 2014
A checker (site and tool) for CVE-2014-0160
-
musalbas/heartbleed-masstest ★ 571 · Apr 8, 2014
Multi-threaded tool for scanning many hosts for CVE-2014-0160.
-
titanous/heartbleeder ★ 451 · Apr 8, 2014
OpenSSL CVE-2014-0160 Heartbleed vulnerability test
-
Lekensteyn/pacemaker ★ 331 · Apr 8, 2014
Heartbleed (CVE-2014-0160) client exploit
-
sensepost/heartbleed-poc ★ 170 · Apr 9, 2014
Test for SSL heartbeat vulnerability (CVE-2014-0160)
-
einaros/heartbleed-tools ★ 99 · Apr 15, 2014
OpenSSL Heartbleed (CVE-2014-0160) vulnerability scanner, data miner and RSA key-restore tools.
-
mpgn/heartbleed-PoC ★ 85 · Mar 8, 2015
:broken_heart: Hearbleed exploit to retrieve sensitive information CVE-2014-0160 :broken_heart:
-
isgroup/openmagic ★ 40 · Apr 8, 2014
OpenSSL TLS heartbeat read overrun (CVE-2014-0160)
-
jdauphant/patch-openssl-CVE-2014-0160 ★ 19 · Apr 8, 2014
Patch openssl #heartbleed with ansible
-
DisK0nn3cT/MaltegoHeartbleed ★ 18 · May 1, 2014
Maltego transform to detect the OpenSSL Heartbleed vulnerability (CVE-2014-0160)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 19
- RHSA-2014:0416 Red Hat Security Advisory: rhevm-spice-client security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0378 Red Hat Security Advisory: rhev-hypervisor6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0396 Red Hat Security Advisory: rhev-hypervisor6 security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0377 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2014:0376 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DSA-2896-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10423-1 tor-0.2.8.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10580-1 httrack-3.48.22-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10289-1 stunnel-5.38-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-14-135-05 OpenSSL Vulnerability CISA ICS & IT advisories · Jun 9, 2025
- ICSA-14-135-04 Unified Automation OPC SDK OpenSSL Vulnerability CISA ICS & IT advisories · Jun 9, 2025
- ICSA-14-135-02 Schneider Electric Wonderware Intelligence Security Patch for OpenSSL Vulnerability CISA ICS & IT advisories · Jun 9, 2025
- ICSA-14-128-01 Digi International OpenSSL Vulnerability CISA ICS & IT advisories · Jun 9, 2025
- ICSA-14-126-01A ABB Relion 650 Series OpenSSL Vulnerability (Update A) CISA ICS & IT advisories · Jun 9, 2025
- ICSA-14-105-03B Siemens Industrial Products OpenSSL Heartbleed Vulnerability (Update B) CISA ICS & IT advisories · Jun 9, 2025
- ICSA-15-344-01B Advantech EKI Vulnerabilities (Update B) CISA ICS & IT advisories · Jun 9, 2025
- ICSA-14-105-02A Innominate mGuard OpenSSL HeartBleed Vulnerability CISA ICS & IT advisories · Jun 6, 2025
- ICSA-14-114-01 Certec atvise scada OpenSSL Heartbleed Vulnerability CISA ICS & IT advisories · Jun 6, 2025
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html?sr=36517217
- 1030077 vdb-entry
- 20140408 heartbleed OpenSSL bug CVE-2014-0160 mailing-list
- http://www.getchef.com/blog/2014/04/09/chef-server-heartbleed-cve-2014-0160-releases/
- DSA-2896 vendor-advisory
- HPSBGN03008 vendor-advisory
- HPSBMU03024 vendor-advisory
- RHSA-2014:0396 vendor-advisory
- HPSBHF03021 vendor-advisory
- HPSBHF03136 vendor-advisory
- VU#720951 third-party-advisory
- http://www.splunk.com/view/SP-CAAAMB3
- HPSBMU03033 vendor-advisory
- http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolved-in-TRITON-APX-Version-8-0
- http://www.apcmedia.com/salestools/SJHN-7RKGNM/SJHN-7RKGNM_R4_EN.pdf
- HPSBGN03011 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21670161
- http://www.vmware.com/security/advisories/VMSA-2014-0012.html
- openSUSE-SU-2014:0492 vendor-advisory
- SSRT101846 vendor-advisory
- 20140409 Re: heartbleed OpenSSL bug CVE-2014-0160 mailing-list
- HPSBMU03037 vendor-advisory
- 1030080 vdb-entry
- 57836 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=isg400001843
- HPSBMU03012 vendor-advisory
- HPSBST03001 vendor-advisory
- 66690 vdb-entry
- http://www.innominate.com/data/downloads/manuals/mdm_1.5.2.1_Release_Notes.pdf
- https://filezilla-project.org/versions.php?type=server
- HPSBMU03023 vendor-advisory
- 57483 third-party-advisory
- 20140409 OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products vendor-advisory
- http://www.kerio.com/support/kerio-control/release-history
- http://advisories.mageia.org/MGASA-2014-0165.html
- http://www.blackberry.com/btsc/KB35882
- HPSBMU03044 vendor-advisory
- HPSBMU03030 vendor-advisory
- 1030081 vdb-entry
- FEDORA-2014-4879 vendor-advisory
- 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities mailing-list
- FEDORA-2014-4910 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1084875
- FEDORA-2014-9308 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=isg400001841
- HPSBMU03013 vendor-advisory
- 1030079 vdb-entry
- RHSA-2014:0377 vendor-advisory
- HPSBMU02995 vendor-advisory
- HPSBPI03031 vendor-advisory
- https://code.google.com/p/mod-spdy/issues/detail?id=85
- HPSBMU02999 vendor-advisory
- HPSBGN03010 vendor-advisory
- HPSBMU03029 vendor-advisory
- http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/
- http://heartbleed.com/
- HPSBMU03018 vendor-advisory
- http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-119-01
- HPSBMU03040 vendor-advisory
- http://cogentdatahub.com/ReleaseNotes.html