ALT-14 · Paper · 23 Oct 2026
Heartbleed: sixty-four kilobytes at a time
A missing bounds check in OpenSSL's heartbeat let anyone read server memory — keys, passwords, sessions. What it was, how widely it reached, and why it changed how open-source infrastructure is funded.
- Mar 2012OpenSSL 1.0.1 ships with the heartbeat extension — and the bug.
- Apr 2014Found independently by Neel Mehta of Google Security and by engineers at Codenomicon.
- 7 Apr 2014Disclosed as CVE-2014-0160; OpenSSL 1.0.1g fixes it the same day.
- Nov 2014“The Matter of Heartbleed” measures the exposure and the patching — and wins a best paper award.
- Memory a single heartbeat request could return
- 64 KBheartbleed.com
- Alexa Top 1M HTTPS servers initially vulnerable
- 24–55%Durumeric et al., IMC 2014
How it worked
A heartbeat is a keep-alive: the client sends a payload and its length, and the server echoes the payload back. OpenSSL trusted the length field. Asked to echo 64 KB but given one byte, it copied whatever followed that byte in memory into the reply.
That memory could hold private keys, session cookies and passwords of other users. Nothing was logged, because to the server it was an ordinary heartbeat.
Why it mattered
Heartbleed showed how much of the internet rested on a library maintained by a handful of people. The Linux Foundation's Core Infrastructure Initiative, funding critical open-source projects, followed within weeks.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- A length field from the network is attacker input. Every protocol parser should treat it as such.
- Rotating keys and certificates after a memory-disclosure bug is not optional: you cannot know what was read.
- Critical infrastructure needs maintainers paid to maintain it.
What it means for you
- Fuzz every parser that reads lengths, offsets or counts from the network.
- Know which TLS library every service links — including inside appliances and containers.
- Have a key-rotation runbook rehearsed before you need it.
Sources
- heartbleed.com — the Heartbleed bug (Codenomicon)
- Durumeric et al. — The Matter of Heartbleed, IMC 2014
- NVD — CVE-2014-0160
Altumptic was not involved in this research. Figures are as published by the sources above.
Cite this entry
Altumptic Lab (2026). ALT-14 — Heartbleed: sixty-four kilobytes at a time. 23 Oct 2026. altumptic.com/research/heartbleed-2014