CVE-2004-0081: OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers t...

Security readout for executives and security teams

CVE-2004-0081 is a remote denial-of-service flaw in OpenSSL 0.9.6 before 0.9.6d. A malformed or unexpected TLS message type can make affected software loop indefinitely, tying up service resources. The business impact is availability: systems still running this obsolete OpenSSL branch could have TLS services disrupted. Exposure is most likely in legacy systems, embedded appliances, or unsupported operating systems that still include OpenSSL 0.9.6 before 0.9.6d. Modern systems should not normally ship this branch, but old vendor packages and static-linked applications need verification. Treat this as a legacy exposure cleanup item unless vulnerable internet-facing TLS services are found. It is not currently supported by KEV or active exploitation evidence, but availability impact can matter where obsolete OpenSSL remains in production. Mitigation focus: Upgrade OpenSSL to 0.9.6d or later where applicable.; Apply relevant operating system vendor security updates from 2004 advisories.; Replace unsupported systems that cannot receive fixed OpenSSL packages..

Prepared

Jun 30, 2026, 06:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.