CVE-2016-6304

Name: CVE-2016-6304
Creator: NVD / NIST
Published: 2016-09-26T19:59:00.157+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 63.03%

Last modified Jun 17, 2026

CVE-2016-6304 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.. EPSS estimates a 63.03% chance of exploitation in the next 30 days.

Description

Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.

Metrics

CVSS 3.1

7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability

63.03%

99.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-401

Affected Software

Vendor	Product	Versions
Openssl	Openssl	1.0.2
Openssl	Openssl	1.0.2a
Openssl	Openssl	1.0.2b
Openssl	Openssl	1.0.2c
Openssl	Openssl	1.0.2d
Openssl	Openssl	1.0.2e
Openssl	Openssl	1.0.2f
Openssl	Openssl	1.0.2h
Openssl	Openssl	1.1.0
Openssl	Openssl	1.0.1
Openssl	Openssl	1.0.1a
Openssl	Openssl	1.0.1b
Openssl	Openssl	1.0.1c
Openssl	Openssl	1.0.1d
Openssl	Openssl	1.0.1e
Openssl	Openssl	1.0.1f
Openssl	Openssl	1.0.1g
Openssl	Openssl	1.0.1h
Openssl	Openssl	1.0.1i
Openssl	Openssl	1.0.1j
Openssl	Openssl	1.0.1k
Openssl	Openssl	1.0.1l
Openssl	Openssl	1.0.1m
Openssl	Openssl	1.0.1n
Openssl	Openssl	1.0.1o
Openssl	Openssl	1.0.1p
Openssl	Openssl	1.0.1q
Openssl	Openssl	1.0.1r
Openssl	Openssl	1.0.1s
Openssl	Openssl	1.0.1t
Nodejs	Node.Js	>= 0.10.0, < 0.10.47
Nodejs	Node.Js	>= 0.12.0, < 0.12.16
Nodejs	Node.Js	>= 4.0.0, < 4.6.0
Nodejs	Node.Js	>= 6.0.0, < 6.7.0
Novell	Suse Linux Enterprise Module For Web Scripting	12.0

References

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.htmlMailing List, Third Party Advisory
http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.htmlThird Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-1940.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2802.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1415.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1659.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2016/Dec/47Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2016/Oct/62Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2017/Jul/31Mailing List, Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21995039Third Party Advisory
http://www.debian.org/security/2016/dsa-3673Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-enThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.htmlThird Party Advisory
http://www.securityfocus.com/bid/93150Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036878Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037640Third Party Advisory, VDB Entry
http://www.splunk.com/view/SP-CAAAPSVThird Party Advisory
http://www.splunk.com/view/SP-CAAAPUEThird Party Advisory
http://www.ubuntu.com/usn/USN-3087-1Third Party Advisory
http://www.ubuntu.com/usn/USN-3087-2Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1413Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1414Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1658Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1801Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1802Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2493Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2494Third Party Advisory
https://bto.bluecoat.com/security-advisory/sa132Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10171Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10215Third Party Advisory
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.ascThird Party Advisory
https://security.gentoo.org/glsa/201612-16Third Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24Third Party Advisory
https://www.openssl.org/news/secadv/20160922.txtVendor Advisory
https://www.tenable.com/security/tns-2016-16Third Party Advisory
https://www.tenable.com/security/tns-2016-20Third Party Advisory
https://www.tenable.com/security/tns-2016-21Third Party Advisory
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00012.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00013.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00021.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00029.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00021.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-11/msg00027.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00010.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2017-10/msg00011.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2018-02/msg00032.htmlMailing List, Third Party Advisory
http://packetstormsecurity.com/files/139091/OpenSSL-x509-Parsing-Double-Free-Invalid-Free.htmlThird Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-1940.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-2802.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1415.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-1659.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2016/Dec/47Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2016/Oct/62Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2017/Jul/31Mailing List, Third Party Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21995039Third Party Advisory
http://www.debian.org/security/2016/dsa-3673Third Party Advisory
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170322-01-openssl-enThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.htmlPatch, Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/ovmbulletinoct2016-3090547.htmlThird Party Advisory
http://www.securityfocus.com/bid/93150Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036878Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037640Third Party Advisory, VDB Entry
http://www.splunk.com/view/SP-CAAAPSVThird Party Advisory
http://www.splunk.com/view/SP-CAAAPUEThird Party Advisory
http://www.ubuntu.com/usn/USN-3087-1Third Party Advisory
http://www.ubuntu.com/usn/USN-3087-2Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1413Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1414Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1658Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1801Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1802Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2493Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2494Third Party Advisory
https://bto.bluecoat.com/security-advisory/sa132Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
https://git.openssl.org/?p=openssl.git%3Ba=commit%3Bh=2c0d295e26306e15a92eb23a84a1802005c1c137
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10171Third Party Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10215Third Party Advisory
https://nodejs.org/en/blog/vulnerability/september-2016-security-releases/Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-16:26.openssl.ascThird Party Advisory
https://security.gentoo.org/glsa/201612-16Third Party Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/1749-security-advisory-24Third Party Advisory
https://www.openssl.org/news/secadv/20160922.txtVendor Advisory
https://www.tenable.com/security/tns-2016-16Third Party Advisory
https://www.tenable.com/security/tns-2016-20Third Party Advisory
https://www.tenable.com/security/tns-2016-21Third Party Advisory

Timeline

Published: Sep 26, 2016
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-6304?

How severe is CVE-2016-6304?

CVE-2016-6304 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 63.03% probability of exploitation in the next 30 days.

How do I fix CVE-2016-6304?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-6304?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST