OpenSSL Project: CVE-2014-0160 — Heartbleed buffer over-read in OpenSSL TLS heartbeat
A missing bounds check in OpenSSL's implementation of the TLS Heartbeat extension allowed remote attackers to read up to 64KB of process memory per request — exposing private keys, session tokens, and user credentials from any TLS-terminating server using affected OpenSSL versions.
3 of the 4 practices that failed in this incident are part of the Sentinel-10 — the engineering protocols Concordance flags as most degraded under AI-accelerated development.
This incident pre-dates today's AI-velocity surge. The thesis is that the same practices that failed here will fail faster under AI velocity if not actively governed. Read the Velocity Governance thesis →
Impact
Required reissuing TLS certificates across most of the public internet. Estimated cost of certificate rotation alone: hundreds of millions. Catalysed the Core Infrastructure Initiative funding model for OSS.
Root cause (from published RCA)
A missing bounds check in the TLS heartbeat extension processing allowed an attacker to specify a payload length larger than the actual data sent. The server would respond with the requested bytes from process memory, including data from prior connections. The vulnerability had existed in the codebase for two years before public disclosure.
Concordance protocols that map to this root cause
Click any protocol to see every other indexed incident where it failed.
Primary sources
Related incidents
Other incidents that failed at least one of the same protocols.