CVE-2016-2109: The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before...

Security readout for executives and security teams

CVE-2016-2109 is an OpenSSL denial-of-service issue. A remote party could send a malformed, short ASN.1 encoding that makes vulnerable OpenSSL versions consume excessive memory. The confirmed impact is service availability, not data theft or code execution, based on the supplied sources. Exposure is most likely where products or services use vulnerable OpenSSL libraries to parse attacker-controlled ASN.1 data, including TLS, certificate, or cryptographic input paths. Exact affected products depend on vendor packaging and embedded OpenSSL versions. Treat this as a patch hygiene and availability risk. It is not evidenced as actively exploited in the supplied sources, but vulnerable OpenSSL is common and remote denial of service can disrupt exposed business services. Mitigation focus: Upgrade OpenSSL to 1.0.1t, 1.0.2h, or later vendor-supported packages.; Apply relevant OS or appliance security advisories from your vendor.; Check embedded products for bundled vulnerable OpenSSL versions..

Prepared

Jun 13, 2026, 14:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.