Heartbleed (CVE-2014-0160) is one of the most serious security vulnerabilities ever found in internet infrastructure. It affected OpenSSL — used by the vast majority of web servers for HTTPS — and allowed attackers to read protected memory from the server without leaving a trace.
Disclosed in April 2014, it was patched within days. But more than a decade later, some servers are still running vulnerable versions.
How it works
OpenSSL's "heartbeat" extension lets a client check that a connection is still alive. The client sends a small packet; the server echoes it back.
Heartbleed exploited a flaw here: the client could lie about the size of its message, causing the server to return up to 64 kilobytes of memory beyond the message itself. That memory could contain anything currently in the server's working memory — private keys, session tokens, usernames, passwords.
Crucially, this left no log entry. There was no way to know you'd been attacked.
What attackers could steal
- Private SSL keys — allowing decryption of past and future traffic
- Session cookies — enabling account takeover without a password
- Usernames and passwords that happened to be in memory at the time
Am I still at risk?
The vulnerability exists in OpenSSL versions 1.0.1 through 1.0.1f and 1.0.2-beta. Servers running old operating systems or unmaintained infrastructure may never have been patched. If you inherited a server or haven't updated your stack in years, it's worth checking.
threatprobe.app's Basic report includes an active Heartbleed check as part of the full TLS audit.