CVE-2026-42770

Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, 3.1.2 and 3.0 are affected by this issue.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02	Patch
https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb	Patch
https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c	Patch
https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2	Patch
https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070	Patch
https://openssl-library.org/news/secadv/20260609.txt	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl::::::::
	cpe:2.3:a:openssl:openssl:4.0.0:-::::::

History

23 Jul 2026, 08:10

Type	Values Removed	Values Added
Summary		(es) Resumen del problema: Cuando se llama a EVP_PKEY_derive_set_peer() con una clave de par DHX (X9.42), la clave de par no se verifica correctamente para la pertenencia al subgrupo. Resumen del impacto: Un par malicioso que presenta una clave X9.42 que contiene los parámetros p y g de la víctima, una q forjada = r (un pequeño factor primo del cofactor (p?1)/q_local), y un valor público Y de orden r puede recuperar la clave privada de la víctima después de un pequeño número de intentos de intercambio de claves. Cuando se llama a EVP_PKEY_derive_set_peer() con una clave de par DHX (X9.42), la verificación de pertenencia al subgrupo Y^q ? 1 (mod p) se realiza utilizando el propio parámetro q del par, no la q de la clave local. Los parámetros de dominio del par se comparan entonces con los parámetros de dominio de la clave privada, pero el valor de q no se compara. Un par malicioso que presenta una clave X9.42 que contiene la p, g de la víctima, una q forjada = r (un pequeño factor primo del cofactor), y un valor público Y de orden r pasa todas las verificaciones. El secreto compartido toma entonces solo r valores distintos, filtrando priv mod r. Repitiendo para cada factor primo pequeño del cofactor y combinando mediante CRT se recupera la clave privada completa (ataque Lim-Lee / de confinamiento de subgrupo pequeño). La superficie de ataque realista es estrecha: principalmente despliegues de CMP con claves DHX de RA/CA de larga duración y aplicaciones empresariales o gubernamentales a medida que utilizan claves estáticas DHX X9.42 con protocolos interactivos y, por lo tanto, a este problema se le asignó una severidad Baja. Los módulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 se ven afectados por este problema.

20 Jul 2026, 17:17

Type	Values Removed	Values Added
Summary	(en) Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.	(en) Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, 3.1.2 and 3.0 are affected by this issue.

16 Jun 2026, 02:58

Type	Values Removed	Values Added
CPE		cpe:2.3:a:openssl:openssl:4.0.0:-:::::: cpe:2.3:a:openssl:openssl::::::::
First Time		Openssl openssl Openssl
References	~~() https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02 -~~	() https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02 - Patch
References	~~() https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb -~~	() https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb - Patch
References	~~() https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c -~~	() https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c - Patch
References	~~() https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2 -~~	() https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2 - Patch
References	~~() https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070 -~~	() https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070 - Patch
References	~~() https://openssl-library.org/news/secadv/20260609.txt -~~	() https://openssl-library.org/news/secadv/20260609.txt - Vendor Advisory

10 Jun 2026, 08:16

Type	Values Removed	Values Added
References	~~{'url': 'https://github.com/openssl/security/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02', 'source': 'openssl-security@openssl.org'}~~ ~~{'url': 'https://github.com/openssl/security/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb', 'source': 'openssl-security@openssl.org'}~~ ~~{'url': 'https://github.com/openssl/security/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c', 'source': 'openssl-security@openssl.org'}~~ ~~{'url': 'https://github.com/openssl/security/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2', 'source': 'openssl-security@openssl.org'}~~ ~~{'url': 'https://github.com/openssl/security/commit/ca2237ab5615641b662183b077f62c08d75e8070', 'source': 'openssl-security@openssl.org'}~~	() https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02 - () https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb - () https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c - () https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2 - () https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070 -

09 Jun 2026, 21:17

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 3.7

09 Jun 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-09 17:17

Updated : 2026-07-23 08:10

NVD link : CVE-2026-42770

Mitre link : CVE-2026-42770

CVE.ORG link : CVE-2026-42770

JSON object : View

Products Affected

openssl

openssl

CWE

CWE-325

Missing Cryptographic Step

3.7 /10