ACTIVELY EXPLOITED
CVE-2014-0160: OpenSSL Information Disclosure Vulnerability
| Vendor | OpenSSL |
|---|---|
| Product | OpenSSL |
| Actively exploited | Yes |
| Added to CISA KEV | 4 May 2022 |
| CISA federal deadline | 25 May 2022 |
| Weakness (CWE) | CWE-125 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.