Heartbleed: CVE-2014-0160 in OpenSSL
The TLS heartbeat in OpenSSL 1.0.1 to 1.0.1f returned memory of the server process, private keys included.
Published in the NVD on 07/04/2014
CVE-2014-0160
In the CISA catalogue of actively exploited vulnerabilities since 04/05/2022
Exploitation probability (EPSS, 01/11/2026): 99.999 %, percentile 99.996
What is Heartbleed?
Heartbleed is a flaw in the TLS and DTLS implementation of OpenSSL 1.0.1 to 1.0.1f. The heartbeat extension did not handle its packets properly: crafted packets trigger a read past the end of a buffer, and the server returns parts of its process memory. As the NVD notes, this has been used to read private keys.
The NVD rates it at CVSS 7.5, and CISA added it to its catalogue of actively exploited vulnerabilities on 4 May 2022. Debian 12 and 13 ship OpenSSL 3 with the fix.
Affected and fixed versions
OpenSSL 1.0.1
Affected: 1.0.1 - 1.0.1f
Fixed in 1.0.1g
Status in Debian and Ubuntu
Debian 12: openssl
Fixed from package version 1.0.1g-1
Debian 13: openssl
Fixed from package version 1.0.1g-1
The OSV database lists no Ubuntu packages for this flaw.
What to do
Update OpenSSL 1.0.1 to 1.0.1g or later. On a server that ran an affected version we recommend replacing the TLS keys and certificates after the update, because they may have been read.
Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.
Already have an account? Log in and add OpenSSL
Sources
Facts checked on 02/11/2026 against NVD, CISA KEV, FIRST EPSS, the Debian Security Tracker and OSV.
More known vulnerabilities
- PHP2Shell (CVE-2026-109618, CVE-2026-109619)
- Log4Shell (CVE-2021-44228)
- regreSSHion (CVE-2024-6387)
- XZ Backdoor (CVE-2024-3094)
- Shellshock (CVE-2014-6271)