VDB
ALPINE-CVE-2016-6304
ALPINE-CVE-2016-6304
PUBLISHED
CVSS 7.5 HIGH
Record from OSV · Published September 26, 2016
Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| openssl | Alpine:v3.6 | 1.0.2i-r0, 1.0.2 |
| openssl | Alpine:v3.5 | 1.0.2i-r0, 1.0.2 |
| openssl | Alpine:v3.4 | 1.0.2i-r0, 1.0.2 |
| openssl | Alpine:v3.2 | 1.0.2i-r0, 1.0.2 |
| openssl | Alpine:v3.8 | 1.0.2i-r0, 1.0.2 |
| openssl | Alpine:v3.7 | 1.0.2i-r0, 1.0.2 |
| openssl | Alpine:v3.3 | 1.0.2i-r0, 1.0.2 |
Risk scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.6 | openssl | 1.0.1e-r0, 0.9.8j-r0, 0.9.8k-r0 |
| Alpine:v3.5 | openssl | 0.9.8k-r2, 0, 1.0.2-r0 |
| Alpine:v3.4 | openssl | 0, 0.9.8k-r6, 0.9.8l-r0 |
| Alpine:v3.2 | openssl | 0, 1.0.1-r0, 1.0.2h-r1 |
| Alpine:v3.8 | openssl | 1.0.1i-r2, 1.0.1e-r7, 1.0.0g-r0 |
| Alpine:v3.7 | openssl | 1.0.1c-r0, 1.0.0a-r1, 1.0.0a-r2 |
| Alpine:v3.3 | openssl | 1.0.1e-r3, 1.0.2f-r0, 1.0.1h-r0 |
Timeline
- Sep 26, 2016 CVE Published
- Nov 19, 2025 CVE Updated
- May 11, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln ALPINE-CVE-2016-6304
vulnetix vdb fixes ALPINE-CVE-2016-6304Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/ALPINE-CVE-2016-6304/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart