CVE-2018-0732: Client DoS due to large DH parameter

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 47.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-12 · updated 2026-10-08
Weakness: CWE-320

Description

During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 17.10, 18.04
Debian Linux: 8.0
Node.js: from 6.0.0 before 6.8.1; from 6.9.0 before 6.14.4; from 8.0.0 before 8.8.1; from 8.9.0 before 8.11.4; from 10.0.0 before 10.9.0 — fixed in 10.9.0, 6.14.4, 6.8.1, 8.11.4, 8.8.1
OpenSSL: from 1.0.2 through 1.0.2o; from 1.1.0 through 1.1.0h

How to fix

Upgrade to a fixed version: Node.js 10.9.0, 6.14.4, 6.8.1, 8.11.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-0732 or the next vulnerability affects your stack