CVE-2018-0732Client DoS due to large DH parameter
Updated under an hour ago ()
Does this affect you?
It affects OpenSSL and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- openssl
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
OpenSSL OpenSSL openssl:openssl (from the name) | Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h); Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o) | CNA record |
openssl openssl openssl:openssl | from 1.0.2 through 1.0.2o; from 1.1.0 through 1.1.0h | NVD |
canonical ubuntu_linux canonical:ubuntu_linux | 12.04; 14.04; 16.04; 17.10; 18.04 | NVD |
debian debian_linux debian:debian_linux | 8.0 | NVD |
nodejs node.js nodejs:node.js | from 6.0.0 before 6.8.1; from 6.9.0 before 6.14.4; from 8.0.0 before 8.8.1; from 8.9.0 before 8.11.4; from 10.0.0 before 10.9.0 | NVD |
References
- https://lists.debian.org/debian-lts-announce/2018/07/msg00043.htmlmailing-list, x-refsource-mlist
- http://www.securityfocus.com/bid/104442vdb-entry, x-refsource-bid
- https://www.debian.org/security/2018/dsa-4355vendor-advisory, x-refsource-debian
- https://access.redhat.com/errata/RHSA-2018:2552vendor-advisory, x-refsource-redhat
- https://security.gentoo.org/glsa/201811-03vendor-advisory, x-refsource-gentoo
- https://usn.ubuntu.com/3692-2/vendor-advisory, x-refsource-ubuntu
- https://access.redhat.com/errata/RHSA-2018:2553vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2018:3505vendor-advisory, x-refsource-redhat
- https://usn.ubuntu.com/3692-1/vendor-advisory, x-refsource-ubuntu
- https://access.redhat.com/errata/RHSA-2018:3221vendor-advisory, x-refsource-redhat
- https://www.debian.org/security/2018/dsa-4348vendor-advisory, x-refsource-debian
- http://www.securitytracker.com/id/1041090vdb-entry, x-refsource-sectrack
- https://access.redhat.com/errata/RHSA-2019:1297vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:1296vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:1543vendor-advisory, x-refsource-redhat
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EWC42UXL5GHTU5G77VKBF6JYUUNGSHOM/vendor-advisory, x-refsource-fedora
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBEV5QGDRFUZDMNECFXUSN5FMYOZDE4V/vendor-advisory, x-refsource-fedora
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y3IVFGSERAZLNJCK35TEM2R4726XIH3Z/vendor-advisory, x-refsource-fedora
- https://www.oracle.com/security-alerts/cpuapr2020.htmlx-refsource-misc
- http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.htmlx-refsource-confirm
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlx-refsource-confirm
- https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.htmlx-refsource-misc
- https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.htmlx-refsource-misc
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlx-refsource-misc
- https://www.oracle.com/security-alerts/cpujan2021.htmlx-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.