High 7.5Published Nov 13, 2017

CVE-2016-8610A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake.

Updated under an hour ago (Nov 2, 2026, 12:10 AM ET)

Does this affect you?

It affects openssl and 44 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for openssl Exploited in the last 30 days

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection handshake. A remote attacker could use this flaw to make a TLS/SSL server consume an excessive amount of CPU and fail to accept connections from other clients.

CVSS: 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-400
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

openssl openssl openssl:openssl	from 1.0.2 through 1.0.2h; 0.9.8; 1.0.1; 1.1.0	NVD
debian debian_linux debian:debian_linux	8.0	NVD
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop	6.0; 7.0	NVD
redhat enterprise_linux_server redhat:enterprise_linux_server	6.0; 7.0	NVD
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus	7.3; 7.4; 7.6	NVD
redhat enterprise_linux_server_eus redhat:enterprise_linux_server_eus	7.3; 7.4; 7.5; 7.6	NVD
redhat enterprise_linux_server_tus redhat:enterprise_linux_server_tus	7.3; 7.6	NVD
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation	6.0; 7.0	NVD
redhat jboss_enterprise_application_platform redhat:jboss_enterprise_application_platform	6.0.0; 6.4.0	NVD
netapp cn1610_firmware netapp:cn1610_firmware	all versions	NVD
1–10 of 45

References

References

http://rhn.redhat.com/errata/RHSA-2017-0286.html	third-party-advisory
http://rhn.redhat.com/errata/RHSA-2017-0574.html	third-party-advisory
http://rhn.redhat.com/errata/RHSA-2017-1415.html	third-party-advisory
http://rhn.redhat.com/errata/RHSA-2017-1659.html	third-party-advisory
http://seclists.org/oss-sec/2016/q4/224	mailing-list, third-party-advisory
http://www.securityfocus.com/bid/93841	third-party-advisory, vdb-entry
http://www.securitytracker.com/id/1037084	third-party-advisory, vdb-entry
https://access.redhat.com/errata/RHSA-2017:1413	third-party-advisory
https://access.redhat.com/errata/RHSA-2017:1414	third-party-advisory
https://access.redhat.com/errata/RHSA-2017:1658	third-party-advisory
1–10 of 25

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.