CVE-2014-0160

CVE-2014-0160, known as Heartbleed, is a critical buffer over-read vulnerability in OpenSSL versions 1.0.1 through 1.0.1f. It allows remote attackers to extract sensitive information, such as private keys, from process memory by sending malformed Heartbeat Extension packets. This flaw affects a wide range of products including OpenSSL itself, Debian, Red Hat, and Splunk. Rated with a CVSS score of 7.5 (High), Heartbleed is easily exploitable over the network without authentication or user interaction, leading to a complete compromise of confidentiality. Its EPSS score of 0.9447 and FAUCET Risk Score of 100/100 highlight its extreme criticality and widespread impact. Heartbleed has been actively exploited in the wild and is listed on CISA's KEV catalog. Numerous exploit modules are publicly available, including Metasploit and Nuclei templates, along with multiple entries on ExploitDB. The vulnerability has garnered significant community discussion and media coverage, underscoring its historical importance and the widespread efforts to mitigate it.