The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
Conclusion & alert: CVE-2016-2183 is rated High Risk (67.3/100): CVSS High severity, with high exploitation likelihood (EPSS 40.99%, 97th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +3.24% over the last day, indicating growing attacker interest. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-01 | 37.75% | 40.99% | +3.24% |
| 2 | 2026-04-28 | 41.58% | 37.75% | -3.83% |
| 3 | 2026-04-21 | — | 41.58% | — |
Full EPSS history (71 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| 5.0 | 2.0 | MEDIUM |
|
10.0 | 2.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
gentoo
|
normal | CVE-2016-2183: 3 GLSA(s) (201612-16, 201701-65, 201707-01), 4 atom(s) (dev-java/icedtea-bin, dev-java/oracle-jdk-bin, dev-java/oracle-jre-bin, dev-libs/openssl); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2016-2183 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2016-2183 |
suse
|
medium | CVE-2016-2183 severity moderate: SUSE including 740 source package names (MozillaFirefox-68.2.0-78.51.4, MozillaFirefox-branding-SLED-68-21.9.8, …), 1529 product×package rows across 125 product lines (HPE Helion OpenStack 8, Image SLES12-SP4-SAP-Azure, … (125 product lines)): Fixed 1003, Known Not Affected 369, Known Affected 157. | https://www.suse.com/security/cve/CVE-2016-2183/ |
ubuntu
|
low | CVE-2016-2183 low priority: Ubuntu including 8 source packages (gnutls26, gnutls28, …), 80 status rows across 10 suites (artful, bionic, cosmic, disco, precise, trusty, upstream, xenial, yakkety, zesty): DNE 32, released 24, not-affected 17, needs-triage 5, ignored 2. | https://ubuntu.com/security/CVE-2016-2183 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| redhat | jboss_enterprise_application_platform | 6.0.0 | cpe:2.3:a:redhat:jboss_enterprise_application_platform:6.0.0:*:*:*:*:*:*:* |
| redhat | jboss_enterprise_web_server | 1.0.0 | cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.0:*:*:*:*:*:*:* |
| redhat | jboss_enterprise_web_server | 2.0.0 | cpe:2.3:a:redhat:jboss_enterprise_web_server:2.0.0:*:*:*:*:*:*:* |
| redhat | jboss_web_server | 3.0 | cpe:2.3:a:redhat:jboss_web_server:3.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 5.0 | cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 6.0 | cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 7.0 | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| python | python | >= 2.7.0, < 2.7.13 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python | python | >= 3.4.0, < 3.4.7 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| python | python | >= 3.5.0, < 3.5.3 | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| cisco | content_security_management_appliance | 9.6.6-068 | cpe:2.3:a:cisco:content_security_management_appliance:9.6.6-068:*:*:*:*:*:*:* |
| cisco | content_security_management_appliance | 9.7.0-006 | cpe:2.3:a:cisco:content_security_management_appliance:9.7.0-006:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1a | cpe:2.3:a:openssl:openssl:1.0.1a:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1b | cpe:2.3:a:openssl:openssl:1.0.1b:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1c | cpe:2.3:a:openssl:openssl:1.0.1c:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1d | cpe:2.3:a:openssl:openssl:1.0.1d:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1e | cpe:2.3:a:openssl:openssl:1.0.1e:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1f | cpe:2.3:a:openssl:openssl:1.0.1f:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1g | cpe:2.3:a:openssl:openssl:1.0.1g:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1h | cpe:2.3:a:openssl:openssl:1.0.1h:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1i | cpe:2.3:a:openssl:openssl:1.0.1i:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1j | cpe:2.3:a:openssl:openssl:1.0.1j:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1k | cpe:2.3:a:openssl:openssl:1.0.1k:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1l | cpe:2.3:a:openssl:openssl:1.0.1l:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1m | cpe:2.3:a:openssl:openssl:1.0.1m:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1n | cpe:2.3:a:openssl:openssl:1.0.1n:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1o | cpe:2.3:a:openssl:openssl:1.0.1o:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1p | cpe:2.3:a:openssl:openssl:1.0.1p:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1q | cpe:2.3:a:openssl:openssl:1.0.1q:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1r | cpe:2.3:a:openssl:openssl:1.0.1r:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.1t | cpe:2.3:a:openssl:openssl:1.0.1t:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.2a | cpe:2.3:a:openssl:openssl:1.0.2a:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.2b | cpe:2.3:a:openssl:openssl:1.0.2b:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.2c | cpe:2.3:a:openssl:openssl:1.0.2c:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.2d | cpe:2.3:a:openssl:openssl:1.0.2d:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.2e | cpe:2.3:a:openssl:openssl:1.0.2e:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.2f | cpe:2.3:a:openssl:openssl:1.0.2f:*:*:*:*:*:*:* |
| openssl | openssl | 1.0.2h | cpe:2.3:a:openssl:openssl:1.0.2h:*:*:*:*:*:*:* |
| oracle | database | 11.2.0.4 | cpe:2.3:a:oracle:database:11.2.0.4:*:*:*:*:*:*:* |
| oracle | database | 12.1.0.2 | cpe:2.3:a:oracle:database:12.1.0.2:*:*:*:*:*:*:* |
| nodejs | node.js | >= 0.10.0, < 0.10.47 | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* |
| nodejs | node.js | >= 0.12.0, < 0.12.16 | cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:* |
| nodejs | node.js | >= 4.0.0, < 4.1.2 | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |
| nodejs | node.js | >= 4.2.0, < 4.6.0 | cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* |
| nodejs | node.js | >= 6.0.0, < 6.7.0 | cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* |