Vulnerability record · CVE-2014-3470 · published 5 June 2014
CVE-2014-3470: OpenSSL anonymous ECDH client NULL pointer dereference crash
OOpenssl · Openssl
The ssl3_send_client_key_exchange function in OpenSSL mishandles a NULL certificate value when an anonymous ECDH cipher suite is used, causing a NULL pointer dereference. This affects OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, and it matters because a remote peer can crash the client process.
Description
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
AV:N/AC:M/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityCVSS 2.0 rates it MEDIUM (4.3) with only availability impact, but the very high EPSS score warrants prompt patching.
What it is
The ssl3_send_client_key_exchange function in OpenSSL mishandles a NULL certificate value when an anonymous ECDH cipher suite is used, causing a NULL pointer dereference. This affects OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, and it matters because a remote peer can crash the client process.
Impact
An attacker gains a denial of service against the affected OpenSSL client, which crashes. There is no confidentiality or integrity impact per the CVSS vector.
Attack surface
Reached over the network (AV:N) by a remote TLS peer negotiating an anonymous ECDH cipher suite; no authentication is required (Au:N), though the vector notes medium access complexity (AC:M).
Exploitation
Not listed in CISA KEV and no ransomware group usage is documented, but EPSS is very high at 0.85784 (99.7th percentile), indicating elevated predicted exploitation activity; references are advisory and mailing-list entries only.
What to do
- Upgrade OpenSSL to 0.9.8za, 1.0.0m, 1.0.1h or later, or apply the vendor patch for your distribution.
- Disable anonymous ECDH cipher suites in client and server TLS configurations where they are not required.
- Update bundled OpenSSL in dependent products such as MariaDB and Linux distributions listed by vendors.
- Track vendor advisories (Red Hat, Fedora, SUSE, openSUSE, IBM AIX, Juniper) for backported fixes.
Detection
- Monitor for TLS handshakes negotiating anonymous ECDH cipher suites (e.g., TLS_ECDH_anon_*) in network or TLS logs.
- Watch for repeated client process crashes or NULL pointer dereference faults in OpenSSL-linked applications.
- Correlate crash reports with connections to untrusted or unexpected TLS peers.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
11 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-3470 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-3470), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
