Appendix K — Heartbleed Context and Safety Answers

Completed Check

Heartbleed was CVE-2014-0160, a missing bounds check in OpenSSL’s heartbeat handling. A client could send a small heartbeat payload while claiming it was much larger, and vulnerable OpenSSL trusted that claimed length.

The safe answer for this course is to explain the bug, keep testing inside fixtures, and only assess real systems with explicit written permission.

The key idea is the unchecked heartbeat payload length: the client supplied a length, and vulnerable OpenSSL trusted it. The safe course boundary is just as important as the bug summary: use fixtures here, and assess real systems only with explicit written permission.

If your explanation sounds like “the server echoed more memory than it should have”, excellent. That’s the plain-language shape we need before the byte-level work begins.

References: CVE-2014-0160, NVD CVE-2014-0160, and RFC 6520.