CVE-2009-1386
MediumPublic exploitssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
Published Jun 4, 2009 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2009-1386
Key Facts
Patch immediately- CVE-2009-1386 is a medium-severity vulnerability (CVSS 5.0 v2) affecting Openssl, Ubuntu Linux (Canonical), rootio-openssl and 18 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 80% probability of exploitation in the next 30 days.
- Fixed versions are available, including libopenssl-1_1-devel 1.1.1l-1.2, libopenssl-1_1-devel-32bit 1.1.1l-1.2, libopenssl-devel 1.0.2j-2.2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
5.0
AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS (30-day exploit likelihood)
80%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2009-1386 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
Affected Products
42 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| OpensslOpenssl | 0.9.6-15, 0.9.6b-3, 0.9.7a-2 | 0.9.8i |
| Ubuntu LinuxCanonical | 6.06, 8.04, 8.10, 9.04 | n/a |
| rootio-opensslrootio | See advisory | 0.9.8k-1 |
| openssl-develoracle | See advisory | 0.9.8e-12.el5 |
| openssl-perloracle | See advisory | 0.9.8e-12.el5 |
Patched Releases
libopenssl-1_1-devel
1.1.1l-1.2
libopenssl-1_1-devel-32bit
1.1.1l-1.2
libopenssl-devel
1.0.2j-2.2
libopenssl-devel-32bit
1.0.2j-2.2
libopenssl1_0_0
1.0.2j-2.2
libopenssl1_0_0-32bit
1.0.2j-2.2
libopenssl1_0_0-hmac
1.0.2j-2.2
libopenssl1_0_0-hmac-32bit
1.0.2j-2.2
libopenssl1_0_0-steam
1.0.2h-4.1
libopenssl1_0_0-steam-32bit
1.0.2h-4.1
libopenssl1_1
1.1.1l-1.2
libopenssl1_1-32bit
1.1.1l-1.2
libopenssl1_1-hmac
1.1.1l-1.2
Openssl
0:0.9.8e-12.el5, 0.9.8e-12.el5, 0.9.8k-1, 1.0.2j-2.2, 0.9.8i
openssl-1_1
1.1.1l-1.2
openssl-1_1-doc
1.1.1l-1.2
openssl-devel
0.9.8e-12.el5
openssl-doc
1.0.2j-2.2
openssl-perl
0.9.8e-12.el5
rootio-openssl
0.9.8k-1
Timeline
Publicly disclosed
Jun 4, 2009
Last updated
Aug 4, 2026
Weakness Type
- CWE-476 NULL Pointer Dereference
References
- advisoryHPSBMA02492
- advisorySUSE-SR:2009:012
- advisory[security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates
- advisoryhttp://rt.openssl.org/Ticket/Display.html?id=1679&user=guest&pass=guest
- advisoryRHSA-2009:1335
FAQ
Common Questions.
ssl/s3_pkt.c in OpenSSL before 0.9.8i allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a DTLS ChangeCipherSpec packet that occurs before ClientHello.
Affected: Openssl versions 0.9.6-15, 0.9.6b-3, 0.9.7a-2; Ubuntu Linux (Canonical) versions 6.06, 8.04, 8.10, 9.04; rootio-openssl, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including libopenssl-1_1-devel 1.1.1l-1.2, libopenssl-1_1-devel-32bit 1.1.1l-1.2, libopenssl-devel 1.0.2j-2.2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2009-1386 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo