CoursePython from Scratch to Intermediate · Module 10: Intermediate Python · part 72 of 75
Part 72 · Module 10: Intermediate Python

Incident: A reply that trusted the asked-for length

7 min read·14 Oct 2026
Module 10 · Incident file · About 30 minutes

What happened

heartbeat are you there? a lying length trusted April 2014 CVE-2014-0160 1.0.1g length checked OpenSSL, the encryption behind many secure websites
Heartbleed in order: the heartbeat (blue) trusted a lying length, made public in April 2014 (red); the fixed release checks it (green).

In April 2014 a flaw in OpenSSL was made public under the name Heartbleed, recorded as CVE-2014-0160. OpenSSL is free software that many web servers use to encrypt their connections: it is what puts the padlock on a secure website. A CVE (Common Vulnerabilities and Exposures) number is the public identifier given to a known security flaw, so that everyone talks about the same one.

The flaw was in the heartbeat, a small "are you still there?" message. One side sends a short message and says how long it is; the other side sends the same message back. OpenSSL trusted the length the other side sent. Ask for more than you sent, and the reply carried that much memory: whatever happened to lie next to the message.

HONEST "L13", length 3 L13 exactly what was sent LYING "L13", length 60 L13 + 57 more bytes whatever lay next to it
Same three bytes, two claims: the honest length is echoed (green); the lying length returns the memory beside the message (red).

The fixed release, OpenSSL 1.0.1g, came out with the announcement. This file keeps to those facts; the CVE record is the source.

The rest of this part opens with an account

Signing up is free and takes one email. Nothing to pay, and nothing renews.

Start reading free