Is CVE-2009-1378 being actively exploited?

CVE-2009-1378 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2009-1378?

CVE-2009-1378 has a CVSS 2.0 base score of 5.0 (MEDIUM).

CVE-2009-1378

MEDIUM · CVSS 5.0EPSS 12.7%EU EUVD

Multiple memory leaks in the dtls1_process_out_of_seq_message function in ssl/d1_both.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allow remote attackers to cause a denial of service (memory consumption) via DTLS records that (1) are duplicates or (2) have sequence numbers much greater than current sequence numbers, aka "DTLS fragment handling memory leak."

Key facts

CVSS score: 5.0 (v2.0)
Severity: MEDIUM
CVSS vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness (CWE): CWE-401
EPSS score: 12.7% (96th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2009-1376)
Published: May 19, 2009
NVD last modified: June 16, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2009-1376 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.

View on the EU Vulnerability Database

Affected products

canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
openssl / openssl

References

ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-009.txt.asc(Broken Link, Third Party Advisory)
http://cvs.openssl.org/chngview?cn=18188(Broken Link, Patch, Vendor Advisory)
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02029444(Broken Link, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2009-06/msg00003.html(Mailing List, Third Party Advisory)
http://lists.vmware.com/pipermail/security-announce/2010/000082.html(Third Party Advisory)
http://marc.info/?l=openssl-dev&m=124247679213944&w=2(Mailing List, Patch, Third Party Advisory)
http://marc.info/?l=openssl-dev&m=124263491424212&w=2(Exploit, Mailing List, Third Party Advisory)
http://rt.openssl.org/Ticket/Display.html?id=1931&user=guest&pass=guest(Broken Link, Third Party Advisory)
http://secunia.com/advisories/35128(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/35416(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/35461(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/35571(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/35729(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/36533(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/37003(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/38761(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/38794(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/38834(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/42724(Not Applicable, Third Party Advisory)
http://secunia.com/advisories/42733(Not Applicable, Third Party Advisory)
http://security.gentoo.org/glsa/glsa-200912-01.xml(Third Party Advisory)
http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.663049(Mailing List, Third Party Advisory)
http://sourceforge.net/mailarchive/message.php?msg_name=4AD43807.7080105%40users.sourceforge.net(Broken Link)
http://voodoo-circle.sourceforge.net/sa/sa-20091012-01.html(Third Party Advisory)
http://www.mandriva.com/security/advisories?name=MDVSA-2009:120(Not Applicable)
http://www.openwall.com/lists/oss-security/2009/05/18/1(Mailing List, Third Party Advisory)
http://www.redhat.com/support/errata/RHSA-2009-1335.html(Third Party Advisory)
http://www.securityfocus.com/bid/35001(Broken Link, Third Party Advisory, VDB Entry)
http://www.securitytracker.com/id?1022241(Broken Link, Third Party Advisory, VDB Entry)
http://www.ubuntu.com/usn/USN-792-1(Third Party Advisory)
http://www.vupen.com/english/advisories/2009/1377(Permissions Required, Third Party Advisory)
http://www.vupen.com/english/advisories/2010/0528(Permissions Required, Third Party Advisory)
https://kb.bluecoat.com/index?page=content&id=SA50(Broken Link)
https://launchpad.net/bugs/cve/2009-1378(Third Party Advisory)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11309(Broken Link, Tool Signature)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7229(Broken Link, Tool Signature)
https://www.exploit-db.com/exploits/8720(Exploit, Third Party Advisory, VDB Entry)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain