{"id":"CVE-2022-40735","aliases":["EUVD-2022-44003","GHSA-8vmc-7qrc-q5mx","SUSE-SU-2023:2470-1","UBUNTU-CVE-2022-40735","USN-6854-1"],"status":"published","title":"Using long exponents in the Diffie-Hellman Key Agreement Protocol allows remote attackers (from...","description":"The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02635,"percentile":0.8566,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2022-11-14T00:00:00Z","modified":"2026-06-17T05:01:56Z","fixes":[{"ecosystem":"Ubuntu:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.16+Fips1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.16"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.22.5~dfsg-5ubuntu1","12.22.7~dfsg-2ubuntu1","12.22.7~dfsg-2ubuntu3","12.22.9~dfsg-1ubuntu2","12.22.9~dfsg-1ubuntu3","12.22.9~dfsg-1ubuntu3.1","12.22.9~dfsg-1ubuntu3.2","12.22.9~dfsg-1ubuntu3.3","12.22.9~dfsg-1ubuntu3.4","12.22.9~dfsg-1ubuntu3.5","12.22.9~dfsg-1ubuntu3.6","12.22.9~dfsg-1ubuntu3.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-preview:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:FIPS-updates:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.16+Fips1"}]}],"versions":["3.0.2-0ubuntu1.10+Fips1","3.0.2-0ubuntu1.12+Fips1","3.0.2-0ubuntu1.14+Fips1","3.0.2-0ubuntu1.15+Fips1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.16"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1","3.0.2-0ubuntu1.1","3.0.2-0ubuntu1.2","3.0.2-0ubuntu1.4","3.0.2-0ubuntu1.5","3.0.2-0ubuntu1.6","3.0.2-0ubuntu1.7","3.0.2-0ubuntu1.8","3.0.2-0ubuntu1.9","3.0.2-0ubuntu1.10","3.0.2-0ubuntu1.12","3.0.2-0ubuntu1.13","3.0.2-0ubuntu1.14","3.0.2-0ubuntu1.15"]}],"products":[{"vendor":"diffie-hellman_key_exchange_project","product":"diffie-hellman_key_exchange"}],"references":[{"url":"https://github.com/mozilla/ssl-config-generator/issues/162","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://gist.github.com/c0r0n3r/9455ddcab985c50fd1912eabf26e058b","tags":["x_transferred","Third Party Advisory","report"]},{"url":"https://link.springer.com/content/pdf/10.1007/3-540-68339-9_29.pdf","tags":["x_transferred","Technical Description","Third Party Advisory","report"]},{"url":"https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol/links/546c144f0cf20dedafd53e7e/Security-Issues-in-the-Diffie-Hellman-Key-Agreement-Protocol.pdf","tags":["x_transferred","Technical Description","Third Party Advisory","report"]},{"url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf","tags":["x_transferred","Technical Description","Third Party Advisory","US Government Resource","report"]},{"url":"https://www.rfc-editor.org/rfc/rfc4419","tags":["x_transferred","report"]},{"url":"https://www.rfc-editor.org/rfc/rfc5114#section-4","tags":["x_transferred","report"]},{"url":"https://www.rfc-editor.org/rfc/rfc7919#section-5.2","tags":["x_transferred","report"]},{"url":"https://raw.githubusercontent.com/CVEProject/cvelist/9d7fbbcabd3f44cfedc9e8807757d31ece85a2c6/2022/40xxx/CVE-2022-40735.json","tags":["x_transferred","report"]},{"url":"https://www.rfc-editor.org/rfc/rfc3526","tags":["x_transferred","report"]},{"url":"https://dheatattack.gitlab.io/","tags":["x_transferred"]},{"url":"https://ieeexplore.ieee.org/document/10374117","tags":["x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40735"},{"url":"https://dheatattack.gitlab.io"},{"url":"https://github.com/advisories/GHSA-8vmc-7qrc-q5mx"},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232470-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205476","tags":["report"]},{"url":"https://bugzilla.suse.com/1210714","tags":["report"]},{"url":"https://bugzilla.suse.com/1211430","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-40735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2650","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-40735","tags":["report"]},{"url":"https://github.com/openssl/openssl/pull/18480","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40735","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6854-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-40735","description":"The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together.","status":"published","published":"2022-11-14T00:00:00Z","modified":"2024-08-03T12:28:41.552Z","updated_at":"2026-11-02T14:34:30.842561Z"}],"euvd":[{"id":"EUVD-2022-44003","description":"The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together.","status":"published","published":"2022-11-14T00:00:00Z","modified":"2024-08-03T12:28:41Z","updated_at":"2026-11-03T03:25:20.207751Z"}],"ghsa":[{"id":"GHSA-8vmc-7qrc-q5mx","title":"Using long exponents in the Diffie-Hellman Key Agreement Protocol allows remote attackers (from...","description":"Using long exponents in the Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. An attacker may cause asymmetric resource consumption with any common client application which uses a DHE implementation that applies short exponents. The attack may be more disruptive in cases where a client sends arbitrary numbers that are actually not DH public keys (aka the D(HE)ater attack) or can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE. This can affect TLS, SSH, and IKE.","status":"published","published":"2022-11-15T12:00:17Z","modified":"2024-05-03T05:02:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:57:18.91536Z"}],"nvd":[{"id":"CVE-2022-40735","description":"The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together.","status":"published","published":"2022-11-14T23:15:11.423Z","modified":"2026-06-17T05:01:56.98Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"UBUNTU-CVE-2022-40735","description":"The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together.","status":"published","published":"2022-11-14T23:15:00Z","modified":"2026-04-22T13:27:57.817944Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:55.502114Z"},{"id":"SUSE-SU-2023:2470-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- Update to version 3.0.8 (bsc#1207541).\n\n- CVE-2022-40735: Fixed remote trigger of expensive server-side DHE modular-exponentiation with long exponents in Diffie-Hellman Key Agreement Protocol (bsc#1205476).\n- CVE-2023-1255: Fixed input buffer over-read in AES-XTS implementation on 64 bit ARM (bsc#1210714).\n- CVE-2023-2650: Fixed possible DoS translating ASN.1 object identifiers (bsc#1211430).\n","status":"published","published":"2023-06-08T07:47:42Z","modified":"2026-02-04T02:18:08.476554Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"USN-6854-1","title":"openssl vulnerability","description":"It was discovered that OpenSSL failed to choose an appropriately short\nprivate key size when computing shared-secrets in the Diffie-Hellman Key\nAgreement Protocol. A remote attacker could possibly use this issue to cause\nOpenSSL to consume resources, resulting in a denial of service.\n","status":"published","published":"2024-06-27T03:05:54Z","modified":"2026-04-27T17:17:52.709941Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}