CVE-2016-2108
CriticalThe ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.
Published May 5, 2016 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2016-2108, SUSE-SU-2017:0461-1, SUSE-SU-2017:0495-1, SUSE-SU-2017:0585-1, SUSE-SU-2017:0601-1, SUSE-SU-2017:0605-1, SUSE-SU-2018:0112-1, UBUNTU-CVE-2016-2108
Key Facts
Patch immediately- CVE-2016-2108 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Openssl, Android (Google), Enterprise Linux Desktop (Redhat) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 78% probability of exploitation in the next 30 days.
- Fixed versions are available, including compat-openssl097g 0.9.7g-146.22.44.1, compat-openssl097g 0.9.7g-146.22.50.1, compat-openssl097g-32bit 0.9.7g-146.22.44.1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
78%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2016-2108 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.
Affected Products
275 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| OpensslOpenssl | 1.0.2, 1.0.2a, 1.0.2b, 1.0.2-beta1, 1.0.2-beta2, 1.0.2-beta3 | 1.0.1n |
| AndroidGoogle | 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1, 4.1.2, 4.2 | n/a |
| Enterprise Linux DesktopRedhat | 6.0, 7.0 | n/a |
| Enterprise Linux Hpc NodeRedhat | 6.0, 7.0 | n/a |
| Enterprise Linux Hpc Node EusRedhat | 7.2 | n/a |
Patched Releases
compat-openssl097g
0.9.7g-146.22.44.1, 0.9.7g-146.22.50.1
compat-openssl097g-32bit
0.9.7g-146.22.44.1, 0.9.7g-146.22.50.1
compat-openssl098
0.9.8j-105.1, 0.9.8j-12.2, 0.9.8j-97.1
jbcs-httpd24-httpd
0:2.4.23-102.jbcs.el6, 0:2.4.23-102.jbcs.el7
jbcs-httpd24-mod_auth_kerb
0:5.4-35.jbcs.el6, 0:5.4-35.jbcs.el7
jbcs-httpd24-mod_bmx
0:0.9.6-14.GA.jbcs.el6, 0:0.9.6-14.GA.jbcs.el7
jbcs-httpd24-mod_cluster-native
0:1.3.5-13.Final_redhat_1.jbcs.el6, 0:1.3.5-13.Final_redhat_1.jbcs.el7
jbcs-httpd24-mod_jk
0:1.2.41-14.redhat_1.jbcs.el6, 0:1.2.41-14.redhat_1.jbcs.el7
jbcs-httpd24-mod_rt
0:2.4.1-16.GA.jbcs.el6, 0:2.4.1-16.GA.jbcs.el7
jbcs-httpd24-mod_security
0:2.9.1-18.GA.jbcs.el6, 0:2.9.1-18.GA.jbcs.el7
jbcs-httpd24-nghttp2
0:1.12.0-9.jbcs.el6, 0:1.12.0-9.jbcs.el7
jbcs-httpd24-openssl
1:1.0.2h-12.jbcs.el6, 1:1.0.2h-12.jbcs.el7
libopenssl-devel
0.9.8j-0.105.1, 0.9.8j-0.97.1, 1.0.1i-15.1, 1.0.1i-21.1, 1.0.1i-27.16.1, 1.0.1i-47.1, 1.0.1i-54.5.1, 1.0.1k-2.36.1
libopenssl-devel-32bit
0.9.8j-0.105.1, 0.9.8j-0.97.1, 1.0.1i-15.1, 1.0.1i-21.1, 1.0.1k-2.36.1
libopenssl0_9_8
0.9.8j-0.105.1, 0.9.8j-0.97.1, 0.9.8j-105.1, 0.9.8j-12.2, 0.9.8j-97.1, 0.9.8zh-17.1
libopenssl0_9_8-32bit
0.9.8j-0.105.1, 0.9.8j-0.97.1, 0.9.8j-105.1, 0.9.8j-12.2, 0.9.8j-97.1, 0.9.8zh-17.1
libopenssl0_9_8-hmac
0.9.8j-0.105.1, 0.9.8j-0.97.1
libopenssl0_9_8-hmac-32bit
0.9.8j-0.105.1, 0.9.8j-0.97.1
libopenssl0_9_8-x86
0.9.8j-0.105.1, 0.9.8j-0.97.1
libopenssl1_0_0
1.0.1g-0.47.1, 1.0.1g-0.57.1, 1.0.1i-15.1, 1.0.1i-21.1, 1.0.1i-27.16.1, 1.0.1i-27.28.1, 1.0.1i-47.1, 1.0.1i-54.5.1, 1.0.1k-2.36.1
libopenssl1_0_0-32bit
1.0.1g-0.47.1, 1.0.1g-0.57.1, 1.0.1i-15.1, 1.0.1i-21.1, 1.0.1i-27.16.1, 1.0.1i-27.28.1, 1.0.1i-47.1, 1.0.1i-54.5.1, 1.0.1k-2.36.1
libopenssl1_0_0-debuginfo
1.0.1k-2.36.1
libopenssl1_0_0-debuginfo-32bit
1.0.1k-2.36.1
libopenssl1_0_0-hmac
1.0.1i-15.1, 1.0.1i-21.1, 1.0.1i-27.16.1, 1.0.1i-27.28.1, 1.0.1i-47.1, 1.0.1i-54.5.1, 1.0.1k-2.36.1
libopenssl1_0_0-hmac-32bit
1.0.1i-15.1, 1.0.1i-21.1, 1.0.1i-27.16.1, 1.0.1i-27.28.1, 1.0.1i-47.1, 1.0.1i-54.5.1, 1.0.1k-2.36.1
Timeline
Publicly disclosed
May 5, 2016
Last updated
Aug 4, 2026
Weakness Type
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-787 Out-of-bounds Write
References
- advisoryRHSA-2016:0722
- advisoryRHSA-2016:0996
- advisoryRHSA-2016:1137
- advisoryRHSA-2016:2056
- advisoryRHSA-2016:2073
FAQ
Common Questions.
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.
Affected: Openssl versions 1.0.2, 1.0.2a, 1.0.2b, 1.0.2-beta1, 1.0.2-beta2, 1.0.2-beta3; Android (Google) versions 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.1, 4.1.2, 4.2; Enterprise Linux Desktop (Redhat) versions 6.0, 7.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including compat-openssl097g 0.9.7g-146.22.44.1, compat-openssl097g 0.9.7g-146.22.50.1, compat-openssl097g-32bit 0.9.7g-146.22.44.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2016-2108 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo