A separate vulnerability (timing attack) was discovered in OpenSSL's heartbeat code in January 2012, less than a month after being accepted into OpenSSL

The paper discussed in the article, Plaintext-Recovery Attacks Against Datagram TLS:

Abstract - We describe an efficient and full plaintext recovery attack against the OpenSSL implementation of DTLS, and a partial plaintext recovery attack against the GnuTLS implementation of DTLS. The attack against the OpenSSL implementation is a variant of Vaudenay’s padding oracle attack and exploits small timing differences arising during the cryptographic processing of DTLS packets. It would have been prevented if the OpenSSL implementation had been in accordance with the DTLS RFC.

. . .

By bringing new techniques into play, we show that the lack of DTLS error messages is not a serious impediment to the attack – we are able to exploit the DTLS extension for Heartbeat messages [14] to ensure that the timing difference shows up in the timing of Heartbeat response messages rather than error messages. In fact, any upper layer protocol which has messages that also provoke a response message with a predictable delay can be used in place of Heartbeat messages in our attack.

But that's not a vulnerability in the heartbeat code; it merely uses an increased heartbeat latency to grab those two (three?) bits of data regardless of whether the server indicates success or not.