ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2023-3817

Issue summary: Checking excessively long DH keys or parameters may be very slow.

Published Jul 31, 2023 · catalog updated Oct 14, 2026 · OpenSSL OpenSSL

Check if you run it

No confirmed exploitation is on record for CVE-2023-3817. EPSS is 3.05%. Act only if a listed version of OpenSSL OpenSSL is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
3.05%
Remediation
Advisory link
Affected products
cpe openssl/openssl · vendor OpenSSL OpenSSL

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe openssl/openssl1.0.2
  • cpe openssl/openssl1.0.2a
  • cpe openssl/openssl1.0.2b
  • vendor OpenSSL OpenSSLversion unspecified

How to fix CVE-2023-3817

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2023-3817. EPSS is 3.05%. Act only if a listed version of OpenSSL OpenSSL is installed.

Which versions are affected?

Compare what you have installed with 1.0.2, 1.0.2a, 1.0.2b. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-606; CWE-834. EPSS 3.05%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 31, 2023 · NIST NVD

    Detected

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_che

  2. Oct 14, 2026 · NIST NVD

    Updated

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_che

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2023-3817

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2023-3817

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2023-3817

    30-day exploitation probability 3.0%

    first.org
  • NIST NVDVulnerability recordCVE-2023-3817

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters tha

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 16, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.