A buffer over-read in OpenSSL's TLS heartbeat extension exposed up to 64KB of server memory per request — including private keys and session cookies — on ~500,000 web servers (17% of all SSL servers). OpenSSL secured 66% of all web servers but was maintained by essentially one full-time person earning ~$20K/year. Community Health Systems lost 4.5M patient records.
Sources: Cloudflare aftermath
SOURCE_FEW_CONTRIBUTORS flagged 1 full-time maintainer years before; VULN_UNFIXED at disclosure
| Tool | Verdict | Details |
|---|---|---|
| OSS Risk Guard | Caught | SOURCE_FEW_CONTRIBUTORS flagged 1 full-time maintainer years before; VULN_UNFIXED at disclosure |
| Socket | After damage | Detects after CVE published |
| Snyk | After damage | CVE detection after publication; does not flag single-maintainer risk beforehand |
| Sonatype (Nexus) | After damage | Detects after CVE published |
| Black Duck | After damage | Detects after CVE published |
| Endor Labs | After damage | Detects after CVE published |