# CVE-2016-6309

> As of 2024-08-06, CVE-2016-6309 is a vulnerability, EPSS 70.2% (99.3th percentile). Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2016-6309, most recently “OpenSSL "HollowByte" TLS Handshake Memory-Amplification DoS (No CVE Assigned)”.

**Last updated:** 2024-08-06

## What is CVE-2016-6309?

statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service (use-after-free) or possibly execute arbitrary code via a crafted TLS session.

The identifier was first published 3683 days ago.

## Severity and exploitation probability

- **EPSS (FIRST):** 70.2% probability of exploitation in the next 30 days, higher than 99.3% of all scored CVEs
- **CISA KEV:** Not listed in the CISA Known Exploited Vulnerabilities catalog
- **Threadlinqs priority:** 6/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- **Published:** 2016-09-26, last modified 2024-08-06

## Is CVE-2016-6309 being exploited?

Weaponised exploit code for CVE-2016-6309 is publicly available. 1 public proof-of-concept repository is tracked for this identifier. It currently carries a trending score of 38 in the Threadlinqs vulnerability feed.

- [trickest/cve](https://github.com/trickest/cve/blob/main/2016/CVE-2016-6309.md) (trickest)

## Affected products and versions

No affected-product or package list has been recorded for CVE-2016-6309 in the tracked sources. The vendor advisory and the references below are the authoritative statement of what is affected.

## How to fix CVE-2016-6309

No vendor patch reference has been recorded for CVE-2016-6309 in the tracked sources. Follow the references below for a fix, and treat any affected deployment as exposed until the vendor states otherwise.

## Threat activity tracking CVE-2016-6309

1 tracked threat in the Threadlinqs corpus references CVE-2016-6309, either in the campaign’s CVE list or as an indicator on the campaign record.

- [OpenSSL "HollowByte" TLS Handshake Memory-Amplification DoS (No CVE Assigned)](https://intel.threadlinqs.com/threat/TL-2026-1459) — MEDIUM · 2026-07-17

## Sources

Enriched from CVE.org, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on 2026-10-10.

**Vendor advisory and patch**

- [tenable.com](https://www.tenable.com/security/tns-2016-20)
- [oracle.com](http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html)
- [openssl.org](https://www.openssl.org/news/secadv/20160926.txt)
- [support.hpe.com](https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03856en_us)
- [www-01.ibm.com](http://www-01.ibm.com/support/docview.wss?uid=swg21995039)

**Vulnerability database entry**

- [securitytracker.com — vdb entry](http://www.securitytracker.com/id/1036885)
- [securityfocus.com — vdb entry](http://www.securityfocus.com/bid/93177)

_Showing 7 of 14 recorded references._

Canonical: https://intel.threadlinqs.com/cve/CVE-2016-6309
Full detection coverage and IOCs for threats exploiting CVE-2016-6309 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp