CVE-2016-6304
HighMultiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
Published Feb 24, 2021 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2016-6304, DEBIAN-CVE-2016-6304, UBUNTU-CVE-2016-6304
Key Facts
Patch immediately- CVE-2016-6304 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Node.js (Nodejs), Openssl, Suse Linux Enterprise Module For Web Scripting (Novell) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 63% probability of exploitation in the next 30 days.
- Fixed versions are available, including compat-openssl098 0.9.8j-102.1, compat-openssl098 0.9.8j-15.1, firefox-atk 2.26.1-2.8.4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
63%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2016-6304 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
Affected Products
372 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Node.jsNodejs | See advisory | 0.10.47 |
| OpensslOpenssl | 1.0.1, 1.0.1a, 1.0.1b, 1.0.1-beta1, 1.0.1-beta2, 1.0.1-beta3, 1.0.1c, 1.0.1d | 1.0.2.i-1 |
| Suse Linux Enterprise Module For Web ScriptingNovell | 12.0 | n/a |
| lib32-opensslarch | See advisory | 1:1.0.2.i-1 |
| rootio-opensslrootio | See advisory | 1.0.2i-1 |
Patched Releases
compat-openssl098
0.9.8j-102.1, 0.9.8j-15.1
firefox-atk
2.26.1-2.8.4
firefox-atk-lang
2.26.1-2.8.4
firefox-cairo
1.15.10-2.13.4
firefox-gdk-pixbuf
2.36.11-2.8.4
firefox-gdk-pixbuf-lang
2.36.11-2.8.4
firefox-gdk-pixbuf-query-loaders
2.36.11-2.8.4
firefox-gdk-pixbuf-thumbnailer
2.36.11-2.8.4
firefox-gio-branding-upstream
2.54.3-2.14.7
firefox-glib2
2.54.3-2.14.7
firefox-glib2-lang
2.54.3-2.14.7
firefox-glib2-tools
2.54.3-2.14.7
firefox-gtk3
3.10.9-2.15.3
firefox-gtk3-branding-upstream
3.10.9-2.15.3
firefox-gtk3-data
3.10.9-2.15.3
firefox-gtk3-immodule-amharic
3.10.9-2.15.3
firefox-gtk3-immodule-inuktitut
3.10.9-2.15.3
firefox-gtk3-immodule-multipress
3.10.9-2.15.3
firefox-gtk3-immodule-thai
3.10.9-2.15.3
firefox-gtk3-immodule-vietnamese
3.10.9-2.15.3
firefox-gtk3-immodule-xim
3.10.9-2.15.3
firefox-gtk3-immodules-tigrigna
3.10.9-2.15.3
firefox-gtk3-lang
3.10.9-2.15.3
firefox-gtk3-tools
3.10.9-2.15.3
firefox-harfbuzz
1.7.5-2.7.4
Timeline
Publicly disclosed
Feb 24, 2021
Last updated
Aug 4, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
- CWE-401 Missing Release of Memory after Effective Lifetime
References
- advisoryhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759
- advisorySUSE-SU-2016:2387
- advisoryopenSUSE-SU-2016:2391
- advisorySUSE-SU-2016:2394
- advisoryopenSUSE-SU-2016:2407
FAQ
Common Questions.
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
Affected: Node.js (Nodejs); Openssl versions 1.0.1, 1.0.1a, 1.0.1b, 1.0.1-beta1, 1.0.1-beta2, 1.0.1-beta3, 1.0.1c, 1.0.1d; Suse Linux Enterprise Module For Web Scripting (Novell) versions 12.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including compat-openssl098 0.9.8j-102.1, compat-openssl098 0.9.8j-15.1, firefox-atk 2.26.1-2.8.4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2016-6304 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo