CVE-2014-0160

A malformed heartbeat request tricks a vulnerable OpenSSL into replying with whatever happens to sit next to the request in process memory, up to 64KB at a time. There's no authentication, nothing crashes, and nothing lands in a log. A defender's problem isn't just that data leaks, it's what leaks: session cookies, credentials, and famously the server's own private TLS key, all readable a chunk at a time by anyone who can open a TLS connection.

The reason Heartbleed still deserves attention years after the headlines is that the vulnerable code got baked into places nobody patches on a Tuesday: load balancers, VPN concentrators, IP cameras, industrial gear, anything that statically linked a 1.0.1 OpenSSL and shipped. It is silent by design, so there's no post-hoc alert telling you whether keys already walked out the door, and the class of attacker ranges from opportunistic scanners to intelligence services.

Our job here is dependency archaeology, not advisory-reading. The mainstream web servers were fixed long ago; the risk lives in appliances and embedded stacks where OpenSSL is invisible to a package manager. We inventory where the vulnerable library is actually linked, and we treat any exposed instance as a key-compromise event, not a patching event: rotating certificates and secrets matters as much as bumping the version.