OpenSSL 0.9.6k allows remote attackers to cause a denial of service (crash via large recursion) via malformed ASN.1 sequences.

published 2003-11-06 23 y ago modified 2026-06-16 4 mo ago also EUVD-2003-0842

cvss: 5.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 6.1%; EPSS 6.1% chance of exploitation in 30 days, percentile 93%
public exploits: 0; none known

Patch / fix

links 3

securityfocus.com/bid/8970 advisory
openssl.org/news/secadv_20031104.txt advisory
kb.cert.org/vuls/id/412478 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2003-0851 updated 2025-11-21

security flaw

Red Hat Enterprise Linux ES version 2.1 Red Hat Enterprise Linux WS version 2.1 Red Hat Linux Advanced Workstation 2.1
fixed: vendor fix RHSA-2004:119
Red Hat Stronghold 4
fixed: vendor fix RHSA-2004:139

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

6.07% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Technology feeds

References

securityfocus.com /bid/8970
vdb-entry, patch, vendor-advisory
openssl.org /news/secadv_20031104.txt
patch, vendor-advisory
kb.cert.org /vuls/id/412478
third-party-advisory, patch, us-government-resource
redhat.com /archives/fedora-announce-list/2005-October/msg00087.html
vendor-advisory
cisco.com /warp/public/707/cisco-sa-20030930-ssl.shtml
vendor-advisory
rhn.redhat.com /errata/RHSA-2004-119.html
vendor-advisory
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5528
vdb-entry, signature
secunia.com /advisories/17381
third-party-advisory
marc.info /?l=bugtraq&m=106796246511667&w=2
mailing-list
marc.info /?l=bugtraq&m=108403850228012&w=2
mailing-list

Sources

CVE List CVE-2003-0851
NVD CVE-2003-0851

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary