Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2016-2109

40
FAUCET Score

CVE-2016-2109 is a denial-of-service vulnerability in OpenSSL versions prior to 1.0.1t and 1.0.2h, specifically within the ASN.1 BIO implementation, affecting products like OpenSSL and Red Hat. This high-severity vulnerability (CVSS 7.5) allows remote attackers to cause memory exhaustion by sending a short, invalid encoding, requiring no user interaction or authentication. While there is no known active exploitation, public exploit code, or Metasploit modules, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
<= 1.0.1sCPE matchmatch criteria
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
1.0.2CPE matchmatch criteria
cpe:2.3:a:openssl:openssl:1.0.2:*:*:*:*:*:*:*
1.0.2CPE matchmatch criteria
cpe:2.3:a:openssl:openssl:1.0.2:beta1:*:*:*:*:*:*
1.0.2CPE matchmatch criteria
cpe:2.3:a:openssl:openssl:1.0.2:beta2:*:*:*:*:*:*
1.0.2CPE matchmatch criteria
cpe:2.3:a:openssl:openssl:1.0.2:beta3:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

7.5HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.0

Exploit Intelligence

EPSS Score
29.21%
Probability of exploitation in next 30 days
EPSS Percentile
98.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.2921 is in the 97th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (14)

redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: openssl-0:1.0.1e-48.el6_8.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 6.7 Extended Update SupportFixed in: openssl-0:1.0.1e-42.el6_7.5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: openssl-1:1.0.1e-51.el7_2.5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 6.4Fixed in: openssl
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCS
View patch
redhatvendor investigatingvia redhat_api
Product: Red Hat JBoss Enterprise Web Server 3Fixed in: openssl
redhatno patchvia redhat_api
Product: Red Hat JBoss Core ServicesFixed in: openssl
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: openssl
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 5Fixed in: openssl097a
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: openssl098e
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: openssl098e
redhatend of lifevia redhat_api
Product: Red Hat JBoss Enterprise Web Server 2Fixed in: openssl
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 4Fixed in: openssl096b
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 4Fixed in: openssl

Vendor Advisories (1)

redhatCVE-2016-2109Low

openssl: ASN.1 BIO handling of large amounts of data

Apr 23, 2016

References

kb.juniper.net / InfoCenter/index
lists.apple.com / archives/security-announce/2016/Jul/msg00000.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00001.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00008.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00010.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00011.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00013.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00014.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00015.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00016.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00017.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00018.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00019.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00029.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00030.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00036.html
lists.opensuse.org / opensuse-security-announce/2016-05/msg00055.html
packetstormsecurity.com / files/136912/Slackware-Security-Advisory-openssl-Updates.html
rhn.redhat.com / errata/RHSA-2016-0722.html
rhn.redhat.com / errata/RHSA-2016-0996.html
rhn.redhat.com / errata/RHSA-2016-2056.html
rhn.redhat.com / errata/RHSA-2016-2073.html
rhn.redhat.com / errata/RHSA-2016-2957.html
bto.bluecoat.com / security-advisory/sa123
cert-portal.siemens.com / productcert/pdf/ssa-412672.pdf
git.openssl.org
h20566.www2.hpe.com / hpsc/doc/public/display
h20566.www2.hpe.com / hpsc/doc/public/display
h20566.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay
h20566.www2.hpe.com / portal/site/hpsc/public/kb/docDisplay
kb.pulsesecure.net / articles/Pulse_Security_Advisories/SA40202
kc.mcafee.com / corporate/index
security.gentoo.org / glsa/201612-16
security.netapp.com / advisory/ntap-20160504-0001
source.android.com / security/bulletin/2017-07-01
support.apple.com / HT206903
freebsd.org / security/advisories/FreeBSD-SA-16:17.openssl.asc
openssl.org / news/secadv/20160503.txt
Vendor Advisory
tenable.com / security/tns-2016-18
tools.cisco.com / security/center/content/CiscoSecurityAdvisory/cisco-sa-20160504-openssl
debian.org / security/2016/dsa-3566
oracle.com / technetwork/security-advisory/cpujan2018-3236628.html
oracle.com / technetwork/security-advisory/cpujul2016-2881720.html
oracle.com / technetwork/security-advisory/cpujul2017-3236622.html
oracle.com / technetwork/security-advisory/cpujul2018-4258247.html
oracle.com / technetwork/security-advisory/cpuoct2016-2881722.html
oracle.com / technetwork/topics/security/bulletinapr2016-2952098.html
oracle.com / technetwork/topics/security/linuxbulletinapr2016-2952096.html
oracle.com / technetwork/topics/security/linuxbulletinjul2016-3090544.html
oracle.com / technetwork/topics/security/ovmbulletinjul2016-3090546.html
securityfocus.com / bid/87940
securityfocus.com / bid/91787
securitytracker.com / id/1035721
slackware.com / security/viewer.php
ubuntu.com / usn/USN-2959-1