CVE-2014-0160

Heartbleed: The 64KB Key to the Kingdom

Alon Barad
Alon Barad
Software Engineer

Jan 2, 2026·7 min read·11 visits

Executive Summary (TL;DR)

OpenSSL trusted the user-supplied length field in Heartbeat packets without verifying the actual payload size. This allowed attackers to 'over-read' the heap, leaking sensitive data like SSL private keys and user passwords. It affected nearly two-thirds of the internet upon disclosure.

A catastrophic missing bounds check in the OpenSSL Heartbeat extension allowed remote attackers to read up to 64KB of process memory, exposing private keys, session tokens, and user credentials.

Official Patches

OpenSSLOpenSSL Security Advisory [07 Apr 2014]

Fix Analysis (1)

Technical Appendix

CVSS Score
7.5/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Probability
94.47%
Top 1% most exploited
200,000
via Shodan

Affected Systems

Apache HTTP ServernginxOpenVPNEmail Servers (SMTP/IMAP/POP3)Load BalancersEmbedded IoT Devices

Affected Versions Detail

Product
Affected Versions
Fixed Version
OpenSSL
OpenSSL Software Foundation
1.0.1 - 1.0.1f1.0.1g
AttributeDetail
CWE IDCWE-126 (Buffer Over-read)
CVSS Score7.5 (High)
Attack VectorNetwork
EPSS Score94.47%
Exploit StatusActive / Weaponized
ImpactInformation Disclosure (Critical)

MITRE ATT&CK Mapping

T1592Gather Victim Host Information
Reconnaissance
T1555Credentials from Password Stores
Credential Access
T1040Network Sniffing
Credential Access
CWE-126
Buffer Over-read

The software reads from a buffer using length parameters that attacker can control, allowing access to memory outside the intended buffer.

Known Exploits & Detection

MetasploitMetasploit module for scanning and dumping memory from Heartbleed-vulnerable servers.
ExploitDBPython script for testing and exploiting CVE-2014-0160.
NucleiDetection Template Available

Vulnerability Timeline

Vulnerability discovered by Google Security and Codenomicon
2014-03-21
Public Disclosure and Patch Release (OpenSSL 1.0.1g)
2014-04-07
Added to CISA KEV Catalog
2022-05-04

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.