Vulnerability record · CVE-2022-0778 · published 15 March 2022
CVE-2022-0778: OpenSSL BN_mod_sqrt infinite loop denial of service
OOpenssl · Openssl
The BN_mod_sqrt() function in OpenSSL loops forever when computing a modular square root for non-prime moduli. This function is reached while parsing certificates or private keys that carry elliptic curve public keys or explicit curve parameters in compressed form, and parsing happens before signature verification. Any process that parses externally supplied certificates or keys can therefore be hung, making this a remotely reachable denial of service.
Description
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityRemote, unauthenticated denial of service with a 7.5 CVSS score and very high EPSS, though it causes availability loss only and is not in KEV.
What it is
The BN_mod_sqrt() function in OpenSSL loops forever when computing a modular square root for non-prime moduli. This function is reached while parsing certificates or private keys that carry elliptic curve public keys or explicit curve parameters in compressed form, and parsing happens before signature verification. Any process that parses externally supplied certificates or keys can therefore be hung, making this a remotely reachable denial of service.
Impact
An attacker can stall or exhaust a worker process or thread indefinitely, denying service to legitimate TLS clients or servers and other certificate-consuming services. No data is read or modified; the effect is availability loss only.
Attack surface
Reached over the network by supplying a crafted certificate, certificate request or private key containing invalid explicit elliptic curve parameters; no authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any component that parses ASN.1 elliptic curve parameters, including TLS clients and servers, CAs and hosting providers, is exposed.
Exploitation
Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high at 0.732 (99.4th percentile), and public proof-of-concept material is referenced via Packet Storm and Full Disclosure. Treat as easily weaponizable for denial of service.
What to do
- Upgrade OpenSSL to 3.0.2, 1.1.1n or 1.0.2zd, or later, and rebuild or restart dependent services.
- Update downstream packages that bundle OpenSSL (Debian, Fedora, Node.js, MariaDB, NetApp, Apple and others) using vendor advisories.
- Where immediate patching is not possible, restrict or rate-limit untrusted certificate and key parsing, and cap per-connection processing time.
- Reject certificates and keys with explicit elliptic curve parameters or compressed points at the application or proxy layer if your use case does not require them.
- Monitor and restart hung TLS or certificate-processing workers as a stopgap.
Detection
- Alert on TLS or certificate-parsing worker processes or threads stuck at high CPU for abnormal durations.
- Monitor connection handling timeouts and thread pool exhaustion on TLS endpoints and certificate authorities.
- Log and review submissions of certificates, CSRs or keys containing explicit EC parameters or compressed points.
- Track OpenSSL version inventory to find hosts still running 1.0.2, 1.1.1 before n, or 3.0.0/3.0.1.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
13 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
Debian Linux Debian
Fedora Fedoraproject
Mariadb Mariadb
N500f Firmware Netapp
NA250 Firmware Netapp
NCloud Volumes Ontap Mediator Netapp
NClustered Data Ontap Netapp
NClustered Data Ontap Antivirus Connector Netapp
NSantricity Smi S Provider Netapp
NStoragegrid Netapp
Node.Js Nodejs
OOpenssl Openssl
Nessus Tenable
References
Track CVE-2022-0778 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-0778), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
