{"id":"CVE-2024-41996","aliases":["BELL-CVE-2024-41996","EUVD-2024-39313","GHSA-h964-f4gx-gw3x","OESA-2025-2325","OESA-2025-2326","OESA-2025-2327","OESA-2026-3419","SUSE-SU-2024:3500-1","SUSE-SU-2024:3501-1","SUSE-SU-2024:3525-1","SUSE-SU-2024:3766-1","SUSE-SU-2024:3871-1","SUSE-SU-2025:20081-1","SUSE-SU-2026:22132-1","UBUNTU-CVE-2024-41996","openSUSE-SU-2024:14366-1"],"status":"published","title":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an...","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.01083,"percentile":0.65462,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2024-08-26T00:00:00Z","modified":"2026-10-15T01:18:41Z","fixes":[{"ecosystem":"Alpaquita:23","package":"openssl","fixed_in":["3.0.15-r4"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"openssl","fixed_in":["3.5.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"openssl","fixed_in":["3.0.15-r4"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","fixed_in":["3.5.0-r0"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"openssl","fixed_in":["3.0.12-22.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"openssl","fixed_in":["3.0.12-22.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"openssl","fixed_in":["3.0.12-22.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","fixed_in":["202308-43.oe2403sp1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-3","fixed_in":["3.0.8-150500.5.45.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"openssl-3","fixed_in":["3.0.8-150500.5.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-3","fixed_in":["3.1.4-150600.5.18.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","fixed_in":["3.1.4-150600.5.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","fixed_in":["3.0.8-150400.4.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","fixed_in":["3.0.8-150400.4.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-3","fixed_in":["3.0.8-150400.4.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-3","fixed_in":["3.0.8-150400.4.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","fixed_in":["3.0.8-150400.4.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-3","fixed_in":["3.0.8-150400.4.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"openssl-3","fixed_in":["3.0.8-150400.4.66.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"openssl-3","fixed_in":["3.0.8-150400.4.66.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","fixed_in":["3.1.4-14.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.15-r4"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.8-r4"},{"fixed":"3.0.15-r4"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.1-r1"},{"fixed":"3.5.0-r0"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-22.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-22.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.12-22.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-43.oe2403sp1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.45.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.18.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-150600.5.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.66.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.48.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150500.5.48.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-150400.4.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-slfo.1.1_10.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.4-14.1"}]}]}],"products":[{"vendor":"diffie-hellman_key_exchange_project","product":"diffie-hellman_key_exchange"},{"vendor":"siemens","product":"ruggedcom rst2428p"},{"vendor":"siemens","product":"scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family"},{"vendor":"siemens","product":"scalance xch328"},{"vendor":"siemens","product":"scalance xcm324"},{"vendor":"siemens","product":"scalance xcm328"},{"vendor":"siemens","product":"scalance xcm332"},{"vendor":"siemens","product":"scalance xrh334 (24 v dc, 8xfo, cc)"},{"vendor":"siemens","product":"scalance xrm334 (230 v ac, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (230 v ac, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (230v ac, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"scalance xrm334 (24 v dc, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (24 v dc, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (24v dc, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"scalance xrm334 (2x230 v ac, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (2x230 v ac, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (2x230v ac, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"sidis prime"},{"vendor":"siemens","product":"simatic s7-1500 tm mfp - gnu/linux subsystem"}],"references":[{"url":"https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1","tags":["report"]},{"url":"https://dheatattack.gitlab.io/details/","tags":["report"]},{"url":"https://dheatattack.gitlab.io/faq/","tags":["report"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-089022.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-485750.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41996","tags":["advisory"]},{"url":"https://dheatattack.gitlab.io/details"},{"url":"https://dheatattack.gitlab.io/faq"},{"url":"https://github.com/advisories/GHSA-h964-f4gx-gw3x"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2024-41996","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2325","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2326","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2327","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3419","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243500-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1230698","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41996","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243501-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243525-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243766-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220262","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-50782","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243871-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520081-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622132-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260446","tags":["report"]},{"url":"https://bugzilla.suse.com/1261678","tags":["report"]},{"url":"https://bugzilla.suse.com/1266340","tags":["report"]},{"url":"https://bugzilla.suse.com/1266341","tags":["report"]},{"url":"https://bugzilla.suse.com/1266342","tags":["report"]},{"url":"https://bugzilla.suse.com/1266344","tags":["report"]},{"url":"https://bugzilla.suse.com/1266349","tags":["report"]},{"url":"https://bugzilla.suse.com/1266353","tags":["report"]},{"url":"https://bugzilla.suse.com/1266355","tags":["report"]},{"url":"https://bugzilla.suse.com/1266356","tags":["report"]},{"url":"https://bugzilla.suse.com/1266357","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9076","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-41996","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-41996","tags":["report"]},{"url":"https://github.com/openssl/openssl/pull/25088","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7JWGVJ2PHE4AS4BVQANRK3JFOO656GY2/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-41996","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.","status":"published","published":"2024-08-26T00:00:00Z","modified":"2026-10-15T00:47:24.457Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:34:04.00829Z"}],"euvd":[{"id":"EUVD-2024-39313","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.","status":"published","published":"2024-08-26T00:00:00Z","modified":"2026-10-15T00:47:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:09.754388Z"}],"ghsa":[{"id":"GHSA-h964-f4gx-gw3x","title":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an...","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.","status":"published","published":"2024-08-26T06:30:46Z","modified":"2026-05-12T12:32:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:08:01.307422Z"}],"nvd":[{"id":"CVE-2024-41996","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.","status":"published","published":"2024-08-26T06:15:04.603Z","modified":"2026-10-15T01:18:41.927Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:10:21.771404Z"}],"osv":[{"id":"BELL-CVE-2024-41996","status":"published","published":"2024-08-28T05:57:42.426457Z","modified":"2026-01-26T09:35:04.302309Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:20.200735Z"},{"id":"OESA-2025-2325","title":"openssl security update","description":"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL tookit and its related documentation.\r\n\r\nSecurity Fix(es):\n\nValidating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.(CVE-2024-41996)","status":"published","published":"2025-09-26T11:09:23Z","modified":"2026-08-18T01:19:11.345201422Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2326","title":"openssl security update","description":"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL tookit and its related documentation.\r\n\r\nSecurity Fix(es):\n\nValidating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.(CVE-2024-41996)","status":"published","published":"2025-09-26T11:09:23Z","modified":"2026-08-18T01:19:11.486456118Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2327","title":"openssl security update","description":"The OpenSSL Project is a collaborative effort to develop a robust, commercial-grade, fully featured, and Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols as well as a full-strength general purpose cryptography library. The project is managed by a worldwide community of volunteers that use the Internet to communicate, plan, and develop the OpenSSL tookit and its related documentation.\r\n\r\nSecurity Fix(es):\n\nValidating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.(CVE-2024-41996)","status":"published","published":"2025-09-26T11:09:23Z","modified":"2026-08-18T01:19:11.373371506Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2026-3419","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nValidating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.(CVE-2024-41996)","status":"published","published":"2026-08-20T09:55:10Z","modified":"2026-08-20T10:15:07.713742627Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2024-41996","description":"Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.","status":"withdrawn","published":"2024-08-26T06:15:00Z","modified":"2026-07-21T18:23:37.253001145Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:58.679387Z"},{"id":"openSUSE-SU-2024:14366-1","title":"libopenssl-3-devel-3.1.4-14.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.1.4-14.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-09-25T00:00:00Z","modified":"2026-02-04T03:40:27.878359Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2024:3500-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2024-41996: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE (bsc#1230698)\n  ","status":"published","published":"2024-09-30T14:14:17Z","modified":"2026-02-04T04:05:53.225922Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3501-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2024-41996: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE (bsc#1230698)\n  ","status":"published","published":"2024-10-01T14:03:35Z","modified":"2025-05-02T04:36:59.977512Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3525-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2024-41996: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE (bsc#1230698)\n  ","status":"published","published":"2024-10-04T13:21:09Z","modified":"2026-02-04T02:46:24.053938Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3766-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n- CVE-2024-41996: Avoid expensive public key validation for known safe-prime groups (DHEATATTACK) (bsc#1230698)\n","status":"published","published":"2024-10-29T01:34:29Z","modified":"2026-02-04T02:18:56.367414Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3871-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n- CVE-2024-41996: Avoid expensive public key validation for known safe-prime groups (DHEATATTACK) (bsc#1230698)\n","status":"published","published":"2024-11-01T15:20:04Z","modified":"2026-02-04T03:00:57.74217Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2025:20081-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2024-41996: Fixed a denial of service in the Diffie-Hellman Key Agreement Protocol (bsc#1230698).\n- CVE-2023-50782: Implicit rejection in PKCS#1 v1.5 (bsc#1220262)\n","status":"published","published":"2025-02-03T09:06:00Z","modified":"2026-03-23T04:50:03.417116Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2026:22132-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues\n\n- CVE-2024-41996: DHEATATTACK: Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol,\n  when an approved safe prime is used, allows remote attackers to trigger expensive server-side DHE (bsc#1230698).\n- CVE-2026-7383: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion (bsc#1266340).\n- CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption (bsc#1266341).\n- CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with\n  KeyTransportRecipientInfo (bsc#1261678).\n- CVE-2026-34180: Heap Buffer Over-read in ASN.1 Content Parsing (bsc#1266342).\n- CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344).\n- CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption (bsc#1266349).\n- CVE-2026-42770: FFC-DH Peer Validation Uses Attacker-Supplied q (bsc#1266353).\n- CVE-2026-45445: AES-OCB IV Ignored on EVP_Cipher() Path (bsc#1266355).\n- CVE-2026-45446: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes (bsc#1266356).\n- CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify() (bsc#1266357).\n","status":"published","published":"2026-06-11T12:42:44Z","modified":"2026-06-18T18:24:35.630631263Z","updated_at":"2026-11-02T15:54:02.654057Z"}]}}