Vulnerability record · CVE-2018-0732 · published 12 June 2018
CVE-2018-0732: OpenSSL DH key agreement client hang via oversized prime
OOpenssl · Openssl
During a TLS handshake using a DH or DHE ciphersuite, a malicious server can send an extremely large prime value to the client. The client then spends an unreasonable amount of time generating a key for that prime, hanging until the computation finishes. This allows a denial of service against TLS clients using affected OpenSSL versions.
Description
During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityCVSS 7.5 with network reachability and no authentication, plus a very high EPSS percentile, though impact is limited to denial of service.
What it is
During a TLS handshake using a DH or DHE ciphersuite, a malicious server can send an extremely large prime value to the client. The client then spends an unreasonable amount of time generating a key for that prime, hanging until the computation finishes. This allows a denial of service against TLS clients using affected OpenSSL versions.
Impact
An attacker acting as a TLS server can stall a connecting client for an extended period, consuming CPU and blocking the handshake. The result is a denial of service; there is no confidentiality or integrity impact.
Attack surface
Reached over the network during the TLS handshake when the client negotiates a DH(E) ciphersuite with a malicious or compromised server. No authentication or user interaction is required, per the CVSS vector AV:N/AC:L/PR:N/UI:N.
Exploitation
Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.488 probability, 98.8th percentile), and references are patch and advisory entries rather than exploit write-ups.
What to do
- Upgrade OpenSSL to 1.1.0i or later, or 1.0.2p or later, and apply the corresponding vendor patches (Ubuntu, Debian, Red Hat, Node.js, Oracle, NetApp, Gentoo, Siemens, Palo Alto advisories are referenced).
- Where DH(E) ciphersuites are not required, disable them or prefer ECDHE to remove the affected code path.
- Apply vendor errata for bundled OpenSSL in Node.js and other products rather than relying on the system library alone.
- Set handshake and connection timeouts so a stalled key agreement does not hold resources indefinitely.
Detection
- Monitor TLS clients for abnormally long handshake or key-agreement durations and CPU spikes tied to DH parameter processing.
- Alert on outbound TLS connections to untrusted or unexpected servers negotiating DHE ciphersuites.
- Track OpenSSL library versions across hosts and flag those still in the affected 1.1.0-1.1.0h and 1.0.2-1.0.2o ranges.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-0732 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-0732), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
