CVE Feed

Dashboard / CVE / CVE-2016-6304

CVE-2016-6304

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

Published:Sep 22, 2016

Last Modified:Apr 12, 2025

EPS:Sep 26, 2016

EPSS Score:0.24314

CVSS Score:7.5

Affected Products

Vendor

Product

Action

Vendor

Nodejs

Product

Node.js

Nodejs

Node.js

Vendor

Novell

Product

Suse Linux Enterprise Module For Web Scripting

Novell

Suse Linux Enterprise Module For Web Scripting

Vendor

Openssl

Product

Openssl

Openssl

Openssl

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Jboss Core Services

Redhat

Jboss Core Services

Vendor

Redhat

Product

Jboss Enterprise Application Platform

Redhat

Jboss Enterprise Application Platform

Vendor

Redhat

Product

Jboss Enterprise Web Server

Redhat

Jboss Enterprise Web Server

Vendor

Redhat

Product

Rhel Aus

Redhat

Rhel Aus

Vendor

Redhat

Product

Rhel Eus

Redhat

Rhel Eus

Vendor

Redhat

Product

Rhel Mission Critical

Redhat

Rhel Mission Critical

Vendor

Redhat

Product

Rhel Tus

Redhat

Rhel Tus

Exploits

No exploit reference

Common Weakness Enumeration

CWE-400 Uncontrolled Resource Consumption

CWE-401 Missing Release of Memory after Effective Lifetime

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-147 XML Ping of the Death

CAPEC-227 Sustained Client Engagement

CAPEC-492 Regular Expression Exponential Blowup

Related CVEs

CVE-2026-58043 (CVSS 8.4) — A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix bound…

CVE-2026-56847 (CVSS 6.1) — A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Log…

CVE-2026-56850 (CVSS 4.4) — A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS …

CVE-2026-48937 (CVSS 7.5) — A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a `GOAWAY` fra…

CVE-2026-48617 (CVSS 8.2) — A flaw in Node.js Permission Model enforcement allows Bypass via `process.report.writeReport()` Path Misvalida…

CVE-2026-21713 (CVSS 5.9) — A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatur…

CVE-2026-21714 (CVSS 5.3) — A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connectio…

CVE-2026-21716 (CVSS 3.3) — An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API …

CVE-2026-21710 (CVSS 7.5) — A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a heade…

CVE-2026-21717 (CVSS 5.9) — A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, makin…

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html

http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html

http://rhn.redhat.com/errata/RHSA-2016-1940.html

http://rhn.redhat.com/errata/RHSA-2016-2802.html

http://rhn.redhat.com/errata/RHSA-2017-1415.html

http://rhn.redhat.com/errata/RHSA-2017-1659.html

http://seclists.org/fulldisclosure/2016/Dec/47

http://seclists.org/fulldisclosure/2016/Oct/62

http://seclists.org/fulldisclosure/2017/Jul/31

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

http://www.debian.org/security/2016/dsa-3673

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

http://www.securityfocus.com/bid/93150

http://www.securitytracker.com/id/1036878

http://www.securitytracker.com/id/1037640

http://www.splunk.com/view/SP-CAAAPSV

http://www.splunk.com/view/SP-CAAAPUE

http://www.ubuntu.com/usn/USN-3087-1

http://www.ubuntu.com/usn/USN-3087-2

https://access.redhat.com/errata/RHSA-2017:1413

https://access.redhat.com/errata/RHSA-2017:1414

https://access.redhat.com/errata/RHSA-2017:1658

https://access.redhat.com/errata/RHSA-2017:1801

https://access.redhat.com/errata/RHSA-2017:1802

https://access.redhat.com/errata/RHSA-2017:2493

https://access.redhat.com/errata/RHSA-2017:2494

https://bto.bluecoat.com/security-advisory/sa132

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

https://kc.mcafee.com/corporate/index?page=content&id=SB10171

https://kc.mcafee.com/corporate/index?page=content&id=SB10215

https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc

https://security.gentoo.org/glsa/201612-16

https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24

https://www.openssl.org/news/secadv/20160922.txt

https://www.tenable.com/security/tns-2016-16

https://www.tenable.com/security/tns-2016-20

https://www.tenable.com/security/tns-2016-21

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html

http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.html

http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.html

http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.html

http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.html

http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.html

http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.html

http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.html

http://rhn.redhat.com/errata/RHSA-2016-1940.html

http://rhn.redhat.com/errata/RHSA-2016-2802.html

http://rhn.redhat.com/errata/RHSA-2017-1415.html

http://rhn.redhat.com/errata/RHSA-2017-1659.html

http://seclists.org/fulldisclosure/2016/Dec/47

http://seclists.org/fulldisclosure/2016/Oct/62

http://seclists.org/fulldisclosure/2017/Jul/31

http://www-01.ibm.com/support/docview.wss?uid=swg21995039

http://www.debian.org/security/2016/dsa-3673

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-en

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html

http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.html

http://www.securityfocus.com/bid/93150

http://www.securitytracker.com/id/1036878

http://www.securitytracker.com/id/1037640

http://www.splunk.com/view/SP-CAAAPSV

http://www.splunk.com/view/SP-CAAAPUE

http://www.ubuntu.com/usn/USN-3087-1

http://www.ubuntu.com/usn/USN-3087-2

https://access.redhat.com/errata/RHSA-2017:1413

https://access.redhat.com/errata/RHSA-2017:1414

https://access.redhat.com/errata/RHSA-2017:1658

https://access.redhat.com/errata/RHSA-2017:1801

https://access.redhat.com/errata/RHSA-2017:1802

https://access.redhat.com/errata/RHSA-2017:2493

https://access.redhat.com/errata/RHSA-2017:2494

https://bto.bluecoat.com/security-advisory/sa132

https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf

https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137

https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312

https://kc.mcafee.com/corporate/index?page=content&id=SB10171

https://kc.mcafee.com/corporate/index?page=content&id=SB10215

https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/

https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.asc

https://security.gentoo.org/glsa/201612-16

https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24

https://www.openssl.org/news/secadv/20160922.txt

https://www.tenable.com/security/tns-2016-16

https://www.tenable.com/security/tns-2016-20

https://www.tenable.com/security/tns-2016-21

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High