Vulnerability record · CVE-2016-2842 · published 3 March 2016
CVE-2016-2842: OpenSSL doapr_outch unchecked allocation leads to out-of-bounds write
OOpenssl · Openssl
The doapr_outch function in OpenSSL's crypto/bio/b_print.c fails to verify that a memory allocation succeeds before writing to it. A remote attacker can supply a long string, such as a large amount of ASN.1 data, to trigger an out-of-bounds write or excessive memory consumption. This is a distinct issue from CVE-2016-0799.
Description
The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly have unspecified other impact via a long string, as demonstrated by a large amount of ASN.1 data, a different vulnerability than CVE-2016-0799.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 3.0 score is 9.8 with network reachability, no authentication, and high impact across confidentiality, integrity, and availability, and EPSS is above the 98th percentile.
What it is
The doapr_outch function in OpenSSL's crypto/bio/b_print.c fails to verify that a memory allocation succeeds before writing to it. A remote attacker can supply a long string, such as a large amount of ASN.1 data, to trigger an out-of-bounds write or excessive memory consumption. This is a distinct issue from CVE-2016-0799.
Impact
An attacker can cause a denial of service through a crash or memory exhaustion, and the out-of-bounds write may allow further unspecified impact. The CVSS 3.0 vector rates confidentiality, integrity, and availability as high.
Attack surface
The flaw is reachable remotely over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. It is triggered by processing a long string, for example large ASN.1 data, through the affected OpenSSL code path.
Exploitation
CVE-2016-2842 is not listed in CISA KEV, but EPSS gives a 30-day exploitation probability of 0.53655 (99th percentile). References include a vendor advisory and a git commit, with no public exploit tags present.
What to do
- Upgrade OpenSSL to 1.0.1s or 1.0.2g or later, which contain the fix.
- Apply vendor security updates from Red Hat, Oracle, and HPE that reference this CVE.
- If immediate patching is not possible, limit or filter untrusted ASN.1 and other large string inputs reaching OpenSSL-dependent services.
- Monitor memory usage and process crashes on systems running affected OpenSSL versions as an interim control.
Detection
- Watch for abnormal memory growth or out-of-memory events in processes linked against OpenSSL 1.0.1 before 1.0.1s or 1.0.2 before 1.0.2g.
- Monitor for crashes or restarts of TLS/SSL services that could indicate malformed long-string input.
- Inventory OpenSSL versions across hosts and flag any still on the affected 1.0.1 or 1.0.2 branches.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-2842 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-2842), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
