CVE-2009-1378: Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k a...

Security readout for executives and security teams

This CVE describes a remote denial-of-service risk in older OpenSSL 0.9.8 DTLS handling. A network attacker could send abnormal DTLS records that make the service consume memory over time, potentially degrading or stopping affected services. Exposure is most likely on legacy systems using OpenSSL 0.9.8k or earlier with DTLS reachable over the network. Vendor advisories indicate downstream operating systems and platforms shipped updates, but the supplied data does not enumerate every affected product. Treat as a legacy exposure cleanup item with service-availability impact. Prioritize internet-facing DTLS services and old platforms that may have missed 2009-2010 vendor updates. Mitigation focus: Inventory OpenSSL 0.9.8k and earlier deployments.; Identify services exposing DTLS to untrusted networks.; Apply relevant vendor OpenSSL security updates..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.