Description
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSSL | OpenSSL | All 0.9.8, All 1.0.1, 1.0.2 through 1.0.2h, 1.1.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.0.2j-1 | — |
| Debian 13 | openssl | 1.0.2j-1 | — |
| Debian 12 | openssl | 1.0.2j-1 | — |
| Debian 8 | openssl | 1.0.1t-1+deb8u6 | DSA-3773-1 |
| Debian 7 | openssl | 1.0.1t-1+deb7u2 | DLA-814-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | gnutls28 | 3.4.10-4ubuntu1.2 | USN-3183-1 |
| Ubuntu 16.04 LTS | openssl | 1.0.2g-1ubuntu4.6 | USN-3181-1 |
| Ubuntu 14.04 LTS | gnutls26 | 2.12.23-12ubuntu2.7 | USN-3183-2, USN-3183-1 |
| Ubuntu 14.04 LTS | openssl | 1.0.1f-1ubuntu2.22 | USN-3181-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | openssl +4 | 1:1.0.1e-60.el7_3.1 | RHSA-2017:0286 |
| RHEL 6 | gnutls +3 | 2.12.23-21.el6 | RHSA-2017:0574 |
| RHEL 6 | openssl +3 | 1.0.1e-48.el6_8.4 | RHSA-2017:0286 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Web Server 3 | log4j-eap6 | 1.2.16-12.redhat_3.1.ep6.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat-native | 1.2.8-10.redhat_10.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat7 +11 | 7.0.70-22.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 3 | tomcat8 +11 | 8.0.36-24.ep7.el6 | RHSA-2017:1801 |
| Red Hat JBoss Web Server 2 | jbcs-httpd24-openssl +4 | 1:1.0.2h-13.jbcs.el6 | RHSA-2017:2493 |
| Red Hat JBoss Web Server 2 | tomcat6 +10 | 6.0.41-17_patch_04.ep6.el6 | RHSA-2017:2493 |
| Red Hat JBoss Web Server 2 | tomcat7 +10 | 7.0.54-25_patch_05.ep6.el6 | RHSA-2017:2493 |
| Red Hat JBoss EAP 6 | jbcs-httpd24-openssl +4 | 1:1.0.2h-13.jbcs.el6 | RHSA-2017:1658 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +7 | 2.4.23-120.jbcs.el6 | RHSA-2017:1414, RHSA-2017:1413 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_security | 2.9.1-19.GA.jbcs.el6 | RHSA-2017:1414, RHSA-2017:1413 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.23-120.jbcs.el6 | RHSA-2017:1414, RHSA-2017:1413 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.0.2h-13.jbcs.el6 | RHSA-2017:1414, RHSA-2017:1413 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | compat-openssl098 | 0.9.8j-106.9.1 | SUSE-SU-2018:4068-1 |
| SLES 12 SP3 | compat-openssl098 | 0.9.8j-106.9.1 | SUSE-SU-2018:4068-1 |
| SLES 12 SP2 | compat-openssl098 | 0.9.8j-105.1 | SUSE-SU-2017:0605-1 |
| SLES 12 SP2 | gnutls | 3.2.15-16.1 | SUSE-SU-2017:0348-1 |
| SLES 12 SP1 | compat-openssl098 | 0.9.8j-105.1 | SUSE-SU-2017:0605-1 |
| SLES 12 SP1 | gnutls | 3.2.15-16.1 | SUSE-SU-2017:0348-1 |
| SLES 12 SP1 | openssl | 1.0.1i-54.5.1 | SUSE-SU-2018:3864-1, SUSE-SU-2017:0461-1 |
| SLES 12 | compat-openssl098 | 0.9.8j-105.1 | SUSE-SU-2018:4068-1, SUSE-SU-2017:0605-1 |
| SLES 12 | openssl | 1.0.1i-27.28.1 | SUSE-SU-2019:1553-1, SUSE-SU-2018:0112-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | gnutls | 2.4.1-24.39.67.1 | SUSE-SU-2017:0304-1 |
| SLES 11 SP4 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2018:4274-1, SUSE-SU-2017:0585-1 |
| SLES 11 SP3 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2018:4274-1, SUSE-SU-2017:0585-1 |
| SLES 11 | openssl1 | 1.0.1g-0.57.1 | SUSE-SU-2018:3964-1, SUSE-SU-2017:0495-1 |
| SUSE Studio Onsite 1.3 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2018:4274-1, SUSE-SU-2017:0585-1 |
| SLES for SAP 12 SP4 | compat-openssl098 | 0.9.8j-106.9.1 | SUSE-SU-2018:4068-1 |
| SLES for SAP 12 SP3 | compat-openssl098 | 0.9.8j-106.9.1 | SUSE-SU-2018:4068-1 |
| SLES for SAP 12 SP2 | compat-openssl098 | 0.9.8j-105.1 | SUSE-SU-2018:4068-1, SUSE-SU-2017:0605-1 |
| SLES for SAP 12 SP2 | gnutls | 3.2.15-16.1 | SUSE-SU-2017:0348-1 |
| SLES for SAP 12 SP1 | compat-openssl098 | 0.9.8j-105.1 | SUSE-SU-2018:4068-1, SUSE-SU-2017:0605-1 |
| SLES for SAP 12 SP1 | gnutls | 3.2.15-16.1 | SUSE-SU-2017:0348-1 |
| SLES for SAP 12 SP1 | openssl | 1.0.1i-54.5.1 | SUSE-SU-2018:3864-2, SUSE-SU-2017:0461-1 |
| SLES for SAP 11 SP4 | compat-openssl097g | 0.9.7g-146.22.50.1 | SUSE-SU-2018:3994-1, SUSE-SU-2017:0601-1 |
| SLES for SAP 11 SP4 | gnutls | 2.4.1-24.39.67.1 | SUSE-SU-2017:0304-1 |
| SLES for SAP 11 SP4 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2018:4274-1, SUSE-SU-2017:0585-1 |
| SUSE OpenStack Cloud 5 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
| SUSE Manager Proxy 2.1 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
| SUSE Manager 2.1 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2017:0585-1 |
| SUSE Linux Enterprise Point of Sale 11 SP3 | openssl | 0.9.8j-0.105.1 | SUSE-SU-2018:4274-1, SUSE-SU-2017:0585-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gnutls | 3.7.2-1.2 | openSUSE-SU-2024:10801-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | openssl +4 | 1:1.0.1e-60.el7_3.1 | ELSA-2017-0286 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
cujanovic/CVE-2016-8610-PoC ★ 33 · Dec 27, 2016
CVE-2016-8610 (SSL Death Alert) PoC
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 31
- RHSA-2017:2493 Red Hat Security Advisory: Red Hat JBoss Web Server 2 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:1801 Red Hat Security Advisory: Red Hat JBoss Web Server 3.1.0 Service Pack 1 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:1414 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 6 Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:1658 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.16 natives update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:1413 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.23 Service Pack 1 for RHEL 7 Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:0574 Red Hat Security Advisory: gnutls security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- RHSA-2017:0286 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- WID-SEC-2026-3112 FreeBSD OS: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 31, 2026
- USN-3183-1 gnutls26, gnutls28 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3183-2 gnutls26 vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-3181-1 openssl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-814-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3773-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10801-1 gnutls-3.7.2-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:0112-1 Security update for openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0461-1 Security update for openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0348-1 Security update for gnutls SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3964-1 Security update for openssl1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3994-1 Security update for compat-openssl097g SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:3864-2 Security update for openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0495-1 Security update for openssl1 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:4274-1 Security update for openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0601-1 Security update for compat-openssl097g SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0585-1 Security update for openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0605-1 Security update for compat-openssl098 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:0304-1 Security update for gnutls SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:1553-1 Security update for openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2018:4068-1 Security update for compat-openssl098 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- SUSE-SU-2018:3864-1 Security update for openssl SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2017-0286 Moderate: openssl security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 20, 2017
References
- 93841 vdb-entry
- RHSA-2017:1659 vendor-advisory
- RHSA-2017:1658 vendor-advisory
- RHSA-2017:1801 vendor-advisory
- RHSA-2017:0286 vendor-advisory
- RHSA-2017:1413 vendor-advisory
- RHSA-2017:2494 vendor-advisory
- FreeBSD-SA-16:35 vendor-advisory
- RHSA-2017:1414 vendor-advisory
- [oss-security] 20161024 CVE-2016-8610: SSL Death Alert: OpenSSL SSL/TLS SSL3_AL_WARNING undefined alert Remote DoS mailing-list
- RHSA-2017:0574 vendor-advisory
- DSA-3773 vendor-advisory
- RHSA-2017:1415 vendor-advisory
- 1037084 vdb-entry
- RHSA-2017:1802 vendor-advisory
- RHSA-2017:2493 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://security.netapp.com/advisory/ntap-20171130-0001/
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8610
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commit%3Bh=af58be768ebb690f78530f796e92b8ae5c9a4401
- https://security.360.cn/cve/CVE-2016-8610/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03897en_us
- https://security.paloaltonetworks.com/CVE-2016-8610
- https://www.oracle.com/security-alerts/cpuoct2020.html