Vulnerability record · CVE-2014-3507 · published 13 August 2014
CVE-2014-3507: OpenSSL DTLS zero-length fragment memory leak denial of service
OOpenssl · Openssl
OpenSSL's DTLS implementation mishandles the return value of an insert function in d1_both.c, leaking memory when processing zero-length DTLS fragments. Repeated fragments exhaust process memory, causing a denial of service. The flaw affects OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i.
Description
Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
high priorityUnauthenticated remote memory exhaustion with a very high EPSS score, though no confirmed in-the-wild exploitation or KEV listing.
What it is
OpenSSL's DTLS implementation mishandles the return value of an insert function in d1_both.c, leaking memory when processing zero-length DTLS fragments. Repeated fragments exhaust process memory, causing a denial of service. The flaw affects OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i.
Impact
A remote attacker can drive unbounded memory consumption in a DTLS-enabled service, degrading or halting it. No data confidentiality or integrity impact is described; the effect is availability loss.
Attack surface
Reachable over the network via DTLS traffic to a service using the affected OpenSSL versions. The CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no reference is tagged as exploit code, though EPSS is high at 0.54276 (99th percentile). The record does not confirm public exploit availability.
What to do
- Upgrade OpenSSL to 0.9.8zb, 1.0.0n, 1.0.1i or later, or apply the vendor patch for your distribution.
- If DTLS is not required, disable DTLS listeners and rebuild without DTLS support where feasible.
- Apply memory limits or cgroup constraints to DTLS-serving processes to bound the impact of leaks.
- Monitor vendor advisories (Oracle, IBM AIX, NetBSD, Fedora, openSUSE) for backported fixes and apply them.
Detection
- Monitor DTLS server process memory (RSS) for sustained growth correlated with incoming zero-length fragment traffic.
- Alert on repeated zero-length DTLS fragments or malformed handshake records in network IDS/IPS logs.
- Track process restarts or OOM-killer events on hosts running DTLS services with affected OpenSSL versions.
- Inventory OpenSSL versions across DTLS endpoints and flag any below 0.9.8zb, 1.0.0n, or 1.0.1i.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-3507 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-3507), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
