# What Is POODLE? Definition and Examples

> POODLE is a 2014 attack (CVE-2014-3566) that recovers secrets such as cookies from SSL 3.0 connections in CBC mode by abusing its unchecked padding.

Source: https://ssl.sh/glossary/poodle/
Last updated: 2026-11-10

POODLE was disclosed in October 2014 by Google researchers Bodo Möller, Thai Duong and Krzysztof Kotowicz. [SSL 3.0](https://ssl.sh/glossary/ssl-3-0/) does not specify the contents of CBC padding bytes and its MAC does not cover them, so an attacker who can make the victim's browser send many requests and can modify the ciphertext learns one byte of a secret, such as a session cookie, for roughly every 256 attempts. The "downgraded" in the name refers to how attackers reached SSL 3.0: browsers that failed a TLS handshake retried with older versions, so a man-in-the-middle could force that fallback.

## Why it matters
POODLE left no safe way to use SSL 3.0: its CBC ciphers were broken, and its only other option, [RC4](https://ssl.sh/glossary/rc4/), was already known to be weak. The result was the removal of SSL 3.0 from browsers and servers and its formal deprecation in RFC 7568 in 2015. It also drove adoption of TLS_FALLBACK_SCSV (RFC 7507) against fallback-based [downgrade attacks](https://ssl.sh/glossary/downgrade-attack/). A later variant affected some TLS implementations that did not check CBC padding correctly, which is why scanners also test for "POODLE over TLS".

## Example
Confirm that a server no longer offers SSL 3.0:

```bash
nmap --script ssl-enum-ciphers -p 443 example.com | grep -E 'SSLv3|TLSv1'
```

`SSLv3` should not appear in the output.

## Common misconceptions
- **POODLE is fixed by patching OpenSSL.** The SSL 3.0 flaw is in the protocol itself; the fix is to disable SSL 3.0 entirely.
- **Clients that prefer TLS 1.2 were safe even if the server kept SSL 3.0.** Fallback attacks targeted exactly such clients.
- **POODLE is still a live risk on modern stacks.** Current browsers and TLS libraries ship without SSL 3.0. The remaining risk is old embedded devices and legacy clients, which should be isolated or replaced.

## Related terms

- [SSL 3.0](https://ssl.sh/zh/glossary/ssl-3-0/): SSL 3.0 是 Netscape 设计的安全套接层协议的最后一个版本，1996 年发布，2014 年被 POODLE 攻破，2015 年被 RFC 7568 废弃。
- [降级攻击](https://ssl.sh/zh/glossary/downgrade-attack/): 降级攻击是指攻击者迫使客户端和服务器协商出比双方实际支持的更旧的协议版本或更弱的算法，从而利用其中的弱点。
- [BEAST](https://ssl.sh/zh/glossary/beast/): BEAST 是 2011 年公布的攻击（CVE-2011-3389），利用 SSL 3.0 和 TLS 1.0 中 CBC 模式可预测的 IV，逐字节解密 Cookie 等秘密。
- [RC4](https://ssl.sh/zh/glossary/rc4/): RC4 是 Ron Rivest 在 1987 年设计的流密码，曾在 SSL/TLS 中广泛使用，因密钥流存在统计偏差，2015 年被 RFC 7465 禁止用于 TLS。
- [TLS 1.0](https://ssl.sh/zh/glossary/tls-1-0/): TLS 1.0 是传输层安全协议的第一个版本，1999 年以 RFC 2246 发布，2021 年被 RFC 8996 正式废弃，主流浏览器已不再支持。
- [密码套件](https://ssl.sh/zh/glossary/cipher-suite/): 密码套件是 TLS 客户端和服务器协商使用的一组命名的加密算法组合，例如 TLS_AES_128_GCM_SHA256，决定连接用什么算法保护数据。