Key facts
Each fact is linked to the source that supports it.- The advisory says the flaw can reveal up to 64 KB of memory to a connected client or server. OpenSSL Project
- OpenSSL 1.0.1g is the fixed release named in the advisory. OpenSSL Project
- NVD's CVSS v3.1 score is 7.5; the historical v2 score is 5.0. NIST NVD
Summary
A crafted heartbeat packet can make a TLS or DTLS peer return up to 64 KB of its process memory, potentially exposing keys, session data and credentials.
Component: OpenSSL TLS/DTLS heartbeat extension. Disclosed: 7 April 2014. Last verified: 22 October 2026, 16:45 UTC.
Affected versions
| Product | Affected range | Note |
|---|---|---|
| OpenSSL | 1.0.1 before 1.0.1g | The advisory also names 1.0.2-beta releases. |
Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. OpenSSL Project
Fixed versions
| Product | Fixed version | Note |
|---|---|---|
| OpenSSL | 1.0.1g | Upgrade release. |
Fixed in OpenSSL 1.0.1g. Modern OpenSSL branches are not affected by this 2014 flaw. OpenSSL Project
Conditions and scope
These are the conditions named by the sources. They are not a score and not a prediction.
- A TLS or DTLS service using an affected OpenSSL version.
- The heartbeat extension is enabled.
- The attacker can send crafted heartbeat packets to the service.
Exploitation status
CISA added CVE-2014-0160 to KEV on 4 May 2022. The flaw was widely scanned and used to extract memory; KEV does not quantify incidents.
Present in the downloaded CISA KEV catalog.
Catalog version · checked 22 October 2026, 16:53 UTC · added 2022-05-04.
Severity and scoring
Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.
Mechanism
The TLS heartbeat extension lets one peer echo a payload back. The affected OpenSSL versions did not properly validate the declared payload length, so a small request could cause the peer to return memory beyond the intended buffer. The advisory puts the maximum disclosure at 64 KB per connection.
The direct impact is confidentiality, not code execution. That distinction matters when comparing it with PHP2Shell: a memory leak can expose credentials and keys, but it is a different class of compromise.
Lessons
Heartbleed is a reminder that 'no RCE' does not mean low impact. Credential and key disclosure can force a much larger incident response than a contained crash.
It also shows why the source's exact wording matters. A scanner that only checks a version string can miss a distribution backport; the same verification discipline appears in the PHP2Shell guides.
What to do
- Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
- Interim controls and their limits — how to buy time without claiming a fix.
- Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.
Sources
Sources for this record
- Full text read
- Full text read
- Metadata only
Last verified 22 October 2026, 16:45 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.