What is CVE-2016-2181?

CVE-2016-2181 is a high-severity vulnerability in OpenSSL, classified under CWE-189. CVSS score: 7.5/10. Published 2016-09-16.

How severe is CVE-2016-2181?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2016-2181 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in OpenSSL

CVE-2016-2181

The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence number, which allows remote attackers to cause a denial of service (false-positive packet drops) via spoofed DTLS records, related to rec_layer_d1.c and ssl3_record.c.

Published 2016-09-16 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 0.226 (97.7th percentile), scored 2026-09-28.

Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 97.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.226 · newest: 0.226 · change: 0.000

Affected products

OpenSSL — versions 1.0.1, 1.0.1a, 1.0.1b
Oracle Linux — versions 6, 7

Weakness classification (CWE)

CWE-189

Public proof-of-concept exploits

References

www.securityfocus.com/bid/92982 (VDB Entry, Third Party Advisory, vdb-entry)
www.tenable.com/security/tns-2016-20
www.splunk.com/view/SP-CAAAPUE (Third Party Advisory)
www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
rhn.redhat.com/errata/RHSA-2016-1940.html (vendor-advisory)
www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html (Third Party Advisory)
kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40312 (Third Party Advisory)
www.splunk.com/view/SP-CAAAPSV (Third Party Advisory)
www-01.ibm.com/support/docview.wss (Third Party Advisory)
www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html (Third Party Advisory)

Frequently asked questions

What is CVE-2016-2181?: CVE-2016-2181 is a high-severity vulnerability in OpenSSL, classified under CWE-189. CVSS score: 7.5/10. Published 2016-09-16.
How severe is CVE-2016-2181?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2016-2181 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.