CVE-2016-6305: OpenSSL

High severity, CVSS 7.5. EPSS: 16% chance of exploitation in the next 30 days.

The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by triggering a zero-length record in an SSL_peek call.

Affected products

• OpenSSL OpenSSL: version 1.1.0 only

Published 2016-09-26. Last modified 2026-06-17.