Which vulnerability is an example of Heartbleed?

Although Heartbleed involves reading beyond an intended memory boundary, it is not a buffer overflow because no memory is overwritten and no attacker-controlled code is executed - only existing memory is read.

Heartbleed does not cause service disruption or resource exhaustion; the vulnerable server continues operating normally while leaking memory, so denial of service does not apply.

Command injection requires injecting OS or application commands through unsanitized input; Heartbleed abuses a protocol-level extension to passively read memory and does not execute any injected commands.

Heartbleed exploited a missing bounds check in OpenSSL's TLS heartbeat extension, allowing remote attackers to request up to 64KB of server memory per malformed heartbeat packet. This exposed sensitive data such as private keys, session tokens, and credentials without triggering a crash or service disruption. The defining characteristic is unauthorized disclosure of server memory contents, placing it firmly in the information disclosure category.