CVE-2026-42770
CVE-2026-42770 is a low-severity vulnerability in Openssl with a CVSS 3.x base score of 3.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-325.
Key facts
- Severity: Low (CVSS 3.x base score 3.7)
- EPSS exploit prediction: 0% (17th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-35487
- Weakness: CWE-325
- Affected product: Openssl
- Published:
- Last modified:
Description
Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.
Frequently asked questions
- What is CVE-2026-42770?
- Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue.
- How severe is CVE-2026-42770?
- CVE-2026-42770 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2026-42770 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-42770?
- CVE-2026-42770 primarily affects Openssl. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2026-42770?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-42770 have an EU (EUVD) identifier?
- Yes. CVE-2026-42770 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35487.
- When was CVE-2026-42770 published?
- CVE-2026-42770 was published on 2026-06-09 and last updated on 2026-06-17.
References
- https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02
- https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb
- https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c
- https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2
- https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070
- https://openssl-library.org/news/secadv/20260609.txt
Affected products (2)
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
- cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*
More vulnerabilities in Openssl
- CVE-2009-3245 — Critical (CVSS 10.0): OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c,…
- CVE-2006-3738 — Critical (CVSS 10.0): Buffer overflow in the SSL_get_shared_ciphers function in OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier…
- CVE-2026-31789 — Critical (CVSS 9.8): Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer…
- CVE-2022-2274 — Critical (CVSS 9.8): The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA…
- CVE-2021-3711 — Critical (CVSS 9.8): In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().…
- CVE-2016-6309 — Critical (CVSS 9.8): statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote…
Other CWE-325 vulnerabilities
- CVE-2026-4601 — High (CVSS 8.7): Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the…
- CVE-2025-30147 — High (CVSS 8.7): Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum…
- CVE-2026-45445 — High (CVSS 7.5): Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the…
- CVE-2026-41395 — High (CVSS 7.5): OpenClaw before 2026.3.28 contains a webhook replay vulnerability in Plivo V3 signature verification that canonicalizes…
- CVE-2026-22863 — High (CVSS 7.5): Deno is a JavaScript, TypeScript, and WebAssembly runtime. Before 2.6.0, node:crypto doesn't finalize cipher. The…
- CVE-2025-60704 — High (CVSS 7.5): Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
Browse all CWE-325 vulnerabilities →
Threat intelligence
Threat-intel indicators referencing this CVE:
- 46.235.42.53 (ipv4-addr)
- 121.84.147.45 (ipv4-addr)
- 159.192.132.34 (ipv4-addr)
- 157.7.200.152 (ipv4-addr)
- 157.173.205.202 (ipv4-addr)