CVE-2011-0014: OpenSSL

Medium severity, CVSS 5.0. EPSS: 9.9% chance of exploitation in the next 30 days.

ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access, aka "OCSP stapling vulnerability."

Affected products

• OpenSSL OpenSSL: version 0.9.8h only; version 0.9.8i only; version 0.9.8j only; version 0.9.8k only; version 0.9.8l only; version 0.9.8m only; …

Published 2011-02-19. Last modified 2026-06-16.