Vulnerability record · CVE-2017-3730 · published 4 May 2017
CVE-2017-3730: OpenSSL client NULL pointer dereference in DHE/ECDHE key exchange
OOpenssl · Openssl
OpenSSL 1.1.0 before 1.1.0d crashes when a malicious server supplies bad parameters during a DHE or ECDHE key exchange, causing the client to dereference a NULL pointer. The flaw is a client-side denial of service that affects any application using the vulnerable library to make TLS connections.
Description
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityNetwork-reachable client crash with a public exploit and very high EPSS, though impact is limited to denial of service and no KEV listing.
What it is
OpenSSL 1.1.0 before 1.1.0d crashes when a malicious server supplies bad parameters during a DHE or ECDHE key exchange, causing the client to dereference a NULL pointer. The flaw is a client-side denial of service that affects any application using the vulnerable library to make TLS connections.
Impact
An attacker-controlled server can crash the connecting client process, disrupting availability. There is no confidentiality or integrity impact; the effect is limited to denial of service.
Attack surface
Reached over the network by a malicious or compromised TLS server responding to a client handshake; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Not listed in CISA KEV, but EPSS is high (0.55294, 98.98th percentile) and a public Exploit-DB entry (41192) exists, indicating exploit code is available.
What to do
- Upgrade OpenSSL to 1.1.0d or later, or apply the vendor patch referenced in the OpenSSL security advisory and commit efbe126e.
- Apply the relevant Oracle, Gentoo and HPE advisories for bundled or embedded OpenSSL copies.
- Inventory applications and appliances that link OpenSSL 1.1.0 and confirm their library version.
- Where immediate patching is not possible, restrict outbound TLS connections to trusted servers to reduce exposure to malicious endpoints.
Detection
- Monitor for unexpected crashes or restarts of TLS client processes and correlate with outbound connection events.
- Log and alert on TLS handshake failures or abnormal DHE/ECDHE parameter negotiation from external servers.
- Track OpenSSL library versions across hosts and flag any still reporting 1.1.0 before 1.1.0d.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
7 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-3730 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-3730), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
