Heartbleed

Heartbleed is a <a href="/facts/Security_bug/caelWGhH">security bug</a> in some outdated versions of the <a href="/facts/OpenSSL/aXvs5fo2">OpenSSL</a> <a href="/facts/Cryptography/e94PEVau">cryptography</a> library, which is a widely used implementation of the <a href="/facts/Transport_Layer_Security/pGy16TnA">Transport Layer Security</a> (TLS) protocol. It was introduced into the software in 2012 and publicly disclosed in April 2014. Heartbleed could be exploited regardless of whether the vulnerable OpenSSL instance is running as a TLS server or client. It resulted from improper input validation (due to a missing <a href="/facts/Bounds_check/vnAjD4Lp">bounds check</a>) in the implementation of the TLS <a href="/facts/Heartbeat_(computing)/b8fgB0JJ">heartbeat</a> extension. Thus, the bug's name derived from heartbeat. The vulnerability was classified as a <a href="/facts/Buffer_over-read/UDQH45sD">buffer over-read</a>, a situation where more data can be read than should be allowed.
Heartbleed was registered in the <a href="/facts/Common_Vulnerabilities_and_Exposures/r6uEABNB">Common Vulnerabilities and Exposures</a> database as <a href="/facts/CVE_(identifier)/r6uEABNB">CVE</a>-<a href="https://nvd.nist.gov/vuln/detail/CVE-2014-0160">2014-0160</a>. The federal <a href="/facts/Canadian_Cyber_Incident_Response_Centre/qBXhwSUN">Canadian Cyber Incident Response Centre</a> issued a security bulletin advising system administrators about the bug. A fixed version of OpenSSL was released on 7 April 2014, on the same day Heartbleed was publicly disclosed.
TLS implementations other than OpenSSL, such as <a href="/facts/GnuTLS/y3fYe3RI">GnuTLS</a>, <a href="/facts/Mozilla_Foundation/Y1xYJsDm">Mozilla</a>'s <a href="/facts/Network_Security_Services/y7bq3SV2">Network Security Services</a>, and the <a href="/facts/Security_Support_Provider_Interface/lIeS9tug">Windows platform implementation of TLS</a>, were not affected because the defect existed in the OpenSSL's implementation of TLS rather than in the protocol itself.
System administrators were frequently slow to patch their systems. As of 20 May 2014<a href="https://en.wikipedia.org/w/index.php?title=Heartbleed&action=edit">[update]</a>, 1.5% of the 800,000 most popular TLS-enabled websites were still vulnerable to the bug, and by 21 June 2014<a href="https://en.wikipedia.org/w/index.php?title=Heartbleed&action=edit">[update]</a>, 309,197 public web servers remained vulnerable. According to a 23 January 2017<a href="https://en.wikipedia.org/w/index.php?title=Heartbleed&action=edit">[update]</a> report from <a href="/facts/Shodan_(website)/fHE1RDGs">Shodan</a>, nearly 180,000 internet-connected devices were still vulnerable to the bug, but by 6 July 2017<a href="https://en.wikipedia.org/w/index.php?title=Heartbleed&action=edit">[update]</a>, the number had dropped to 144,000 according to a search performed on shodan.io for the vulnerability. Around two years later, 11 July 2019<a href="https://en.wikipedia.org/w/index.php?title=Heartbleed&action=edit">[update]</a>, Shodan reported that 91,063 devices were vulnerable. The U.S. had the most vulnerable devices, with 21,258 (23%), and the 10 countries with the most vulnerable devices had a total of 56,537 vulnerable devices (62%). The remaining countries totaled 34,526 devices (38%). The report also broke the devices down by 10 other categories such as organization (the top 3 were wireless companies), product (<a href="/facts/Apache_HTTP_Server/tcmWYYUq">Apache httpd</a>, <a href="/facts/Nginx/AlTYUuTp">Nginx</a>), and service (<a href="/facts/HTTPS/MSWYz4zo">HTTPS</a>, 81%).

Heartbleed open-in-new

Heartbleed