CVE catalog

CVE-2016-8610

openssl: CVE-2016-8610

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
39.66% · Oct 25, 2026

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopensslsid3.6.5-1fixed
Debianopensslforky3.6.5-1fixed
Debianopenssltrixie3.5.7-1~deb13u2fixed
Debianopenssltrixie-security3.5.7-1~deb13u3fixed
Debianopensslbookworm3.0.20-1~deb12u2fixed
Debianopensslbookworm-security3.0.22-1~deb12u2fixed
Ubuntugnutls2614.042.12.23-1ubuntu4vulnerable
Ubuntugnutls2614.042.12.23-1ubuntu5vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu1vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.1vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.2vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.3vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.4vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.5vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.6vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.7fixed
Ubuntuopenssl14.041.0.1e-3ubuntu1vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu1vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu2vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu3vulnerable
Ubuntuopenssl14.041.0.1e-4ubuntu4vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu1vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.1vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.2vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.3vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.4vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.5vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.7vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.8vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.11vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.12vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.15vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.16vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.17vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.18vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.19vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.20vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.21vulnerable
Ubuntuopenssl14.041.0.1f-1ubuntu2.22fixed
Ubuntugnutls2816.043.3.15-5ubuntu2vulnerable
Ubuntugnutls2816.043.3.18-1ubuntu1vulnerable
Ubuntugnutls2816.043.3.20-1ubuntu1vulnerable
Ubuntugnutls2816.043.4.9-2ubuntu1vulnerable
Ubuntugnutls2816.043.4.10-4ubuntu1vulnerable
Ubuntugnutls2816.043.4.10-4ubuntu1.1vulnerable
Ubuntugnutls2816.043.4.10-4ubuntu1.2fixed
Ubuntuopenssl16.041.0.2d-0ubuntu1vulnerable
Ubuntuopenssl16.041.0.2d-0ubuntu2vulnerable
Ubuntuopenssl16.041.0.2e-1ubuntu1vulnerable
Ubuntuopenssl16.041.0.2f-2ubuntu1vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu2vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu3vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.1vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.2vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.4vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.5vulnerable
Ubuntuopenssl16.041.0.2g-1ubuntu4.6fixed
Ubuntugnutls2614.042.12.23-1ubuntu4vulnerable
Ubuntugnutls2614.042.12.23-1ubuntu5vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu1vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.1vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.2vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.3vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.4vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.5vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.6vulnerable
Ubuntugnutls2614.042.12.23-12ubuntu2.7fixed
Suseopenssl1linux enterprise server 11-security1.0.1g-0.58.15.1fixed
Susecompat-openssl097glinux enterprise server for sap applications 11 sp40.9.7g-146.22.51.8.1fixed
Suseopenssllinux enterprise server for sap applications 12 sp11.0.1i-54.20.1fixed
Suseopenssllinux enterprise software development kit 11 sp40.9.8j-0.106.18.1fixed
Suseopenssllinux enterprise point of sale 11 sp30.9.8j-0.106.18.1fixed
Suseopenssllinux enterprise server 11 sp3-ltss0.9.8j-0.106.18.1fixed
Suseopenssllinux enterprise server 11 sp3-teradata0.9.8j-0.106.18.1fixed
Suseopenssllinux enterprise server 11 sp40.9.8j-0.106.18.1fixed
Suseopenssllinux enterprise server for sap applications 11 sp40.9.8j-0.106.18.1fixed
Suseopensslstudio onsite 1.30.9.8j-0.106.18.1fixed
Susegnutlslinux enterprise software development kit 11 sp42.4.1-24.39.67.1fixed
Susegnutlslinux enterprise high availability extension 11 sp42.4.1-24.39.67.1fixed
Susegnutlslinux enterprise server 11 sp42.4.1-24.39.67.1fixed
Susegnutlslinux enterprise server for sap applications 11 sp42.4.1-24.39.67.1fixed
Suseopenssllinux enterprise server 12-ltss1.0.1i-27.34.1fixed
Susecompat-openssl098linux enterprise desktop 12 sp30.9.8j-106.9.1fixed
Susecompat-openssl098linux enterprise desktop 12 sp40.9.8j-106.9.1fixed
Susecompat-openssl098linux enterprise module for legacy 120.9.8j-106.9.1fixed
Susecompat-openssl098linux enterprise server for sap applications 12 sp10.9.8j-106.9.1fixed
Susecompat-openssl098linux enterprise server for sap applications 12 sp20.9.8j-106.9.1fixed
Susecompat-openssl098linux enterprise server for sap applications 12 sp30.9.8j-106.9.1fixed
Susecompat-openssl098linux enterprise server for sap applications 12 sp40.9.8j-106.9.1fixed
Suseopenssllinux enterprise server 12 sp1-ltss1.0.1i-54.20.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianopensslsourcesid1.0.2j-1not yet assignedNot reportedNot reported
Debianopensslsourceforky1.0.2j-1not yet assignedNot reportedNot reported
Debianopensslsourcetrixie1.0.2j-1not yet assignedNot reportedNot reported
Debianopensslsourcebookworm1.0.2j-1not yet assignedNot reportedNot reported
Ubuntugnutls26deb14.042.12.23-12ubuntu2.7Not reportedUBUNTU-CVE-2016-8610Not reported
Ubuntuopenssldeb14.041.0.1f-1ubuntu2.22Not reportedUBUNTU-CVE-2016-8610Not reported
Ubuntugnutls28deb16.043.4.10-4ubuntu1.2Not reportedUBUNTU-CVE-2016-8610Not reported
Ubuntuopenssldeb16.041.0.2g-1ubuntu4.6Not reportedUBUNTU-CVE-2016-8610Not reported
Ubuntugnutls26deb14.042.12.23-12ubuntu2.7Not reportedUSN-3183-2Not reported
Suseopenssl1rpmlinux enterprise server 11-security1.0.1g-0.58.15.1Not reportedSUSE-SU-2018:3964-1Not reported
Susecompat-openssl097grpmlinux enterprise server for sap applications 11 sp40.9.7g-146.22.51.8.1Not reportedSUSE-SU-2018:3994-1Not reported
Suseopensslrpmlinux enterprise server for sap applications 12 sp11.0.1i-54.20.1Not reportedSUSE-SU-2018:3864-2Not reported
Suseopensslrpmlinux enterprise software development kit 11 sp40.9.8j-0.106.18.1Not reportedSUSE-SU-2018:4274-1Not reported
Suseopensslrpmlinux enterprise point of sale 11 sp30.9.8j-0.106.18.1Not reportedSUSE-SU-2018:4274-1Not reported
Suseopensslrpmlinux enterprise server 11 sp3-ltss0.9.8j-0.106.18.1Not reportedSUSE-SU-2018:4274-1Not reported
Suseopensslrpmlinux enterprise server 11 sp3-teradata0.9.8j-0.106.18.1Not reportedSUSE-SU-2018:4274-1Not reported
Suseopensslrpmlinux enterprise server 11 sp40.9.8j-0.106.18.1Not reportedSUSE-SU-2018:4274-1Not reported
Suseopensslrpmlinux enterprise server for sap applications 11 sp40.9.8j-0.106.18.1Not reportedSUSE-SU-2018:4274-1Not reported
Suseopensslrpmstudio onsite 1.30.9.8j-0.106.18.1Not reportedSUSE-SU-2018:4274-1Not reported
Susegnutlsrpmlinux enterprise software development kit 11 sp42.4.1-24.39.67.1Not reportedSUSE-SU-2017:0304-1Not reported
Susegnutlsrpmlinux enterprise high availability extension 11 sp42.4.1-24.39.67.1Not reportedSUSE-SU-2017:0304-1Not reported
Susegnutlsrpmlinux enterprise server 11 sp42.4.1-24.39.67.1Not reportedSUSE-SU-2017:0304-1Not reported
Susegnutlsrpmlinux enterprise server for sap applications 11 sp42.4.1-24.39.67.1Not reportedSUSE-SU-2017:0304-1Not reported
Suseopensslrpmlinux enterprise server 12-ltss1.0.1i-27.34.1Not reportedSUSE-SU-2019:1553-1Not reported
Susecompat-openssl098rpmlinux enterprise desktop 12 sp30.9.8j-106.9.1Not reportedSUSE-SU-2018:4068-1Not reported
Susecompat-openssl098rpmlinux enterprise desktop 12 sp40.9.8j-106.9.1Not reportedSUSE-SU-2018:4068-1Not reported
Susecompat-openssl098rpmlinux enterprise module for legacy 120.9.8j-106.9.1Not reportedSUSE-SU-2018:4068-1Not reported
Susecompat-openssl098rpmlinux enterprise server for sap applications 12 sp10.9.8j-106.9.1Not reportedSUSE-SU-2018:4068-1Not reported
Susecompat-openssl098rpmlinux enterprise server for sap applications 12 sp20.9.8j-106.9.1Not reportedSUSE-SU-2018:4068-1Not reported
Susecompat-openssl098rpmlinux enterprise server for sap applications 12 sp30.9.8j-106.9.1Not reportedSUSE-SU-2018:4068-1Not reported
Susecompat-openssl098rpmlinux enterprise server for sap applications 12 sp40.9.8j-106.9.1Not reportedSUSE-SU-2018:4068-1Not reported
Suseopensslrpmlinux enterprise server 12 sp1-ltss1.0.1i-54.20.1Not reportedSUSE-SU-2018:3864-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libssl3]Unknown

    Source package: [openssl]

    Details (6)
    • 3.0.20-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · amd64 · bookworm-updates

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · arm64 · bookworm-updates

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

  • [libssl-dev]Unknown

    Source package: [openssl]

    Details (6)
    • 3.0.20-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · amd64 · bookworm-updates

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · arm64 · bookworm-updates

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

  • [libssl-doc]Unknown

    Source package: [openssl]

    Details (6)
    • 3.0.20-1~deb12u2 · all · bookworm

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · all · bookworm

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · all · bookworm-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · all · bookworm-updates

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · all · bookworm-updates

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

  • [openssl]Unknown
    Details (6)
    • 3.0.20-1~deb12u2 · amd64 · bookworm

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.20-1~deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · amd64 · bookworm-updates

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

    • 3.0.17-1~deb12u2 · arm64 · bookworm-updates

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · bookworm; dsa · openssl · debian · 12

[Debian 13 (Trixie)]

  • [libssl3t64]Unknown

    Source package: [openssl]

    Details (6)
    • 3.5.6-1~deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

  • [libssl-dev]Unknown

    Source package: [openssl]

    Details (6)
    • 3.5.6-1~deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

  • [libssl-doc]Unknown

    Source package: [openssl]

    Details (6)
    • 3.5.6-1~deb13u2 · all · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · all · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · all · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · all · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · all · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · all · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

  • [openssl]Unknown
    Details (6)
    • 3.5.6-1~deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

  • Source package: [openssl]

    Details (6)
    • 3.5.6-1~deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

  • Source package: [openssl]

    Details (6)
    • 3.5.6-1~deb13u2 · amd64 · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · arm64 · trixie

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.6-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · amd64 · trixie-security · Historical version

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

    • 3.5.7-1~deb13u3 · amd64 · trixie-security

      Fixed · Fixed: 1.0.2j-1

      dsa · openssl · debian · 13

Observed:

References