The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows rem

Summary

OpenSSL, the widely used cryptographic library that provides TLS and DTLS encryption for many servers, clients, and applications, is affected. A remote attacker sending specially crafted heartbeat requests could read sensitive data from the process memory, including information such as private encryption keys.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Timeline

1. Apr 7, 2014, 12:00 AM UTCCVE published
2. May 4, 2022Added to CISA KEV

   CISA has evidence of exploitation in the wild

3. May 25, 2022CISA remediation deadline

   Due date for US federal agencies to patch

4. Oct 22, 2025, 12:05 AM UTCRecord last updated
5. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

References 25