EUVD-2026-35487
GHSA-3cxm-476w-ghm2
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (CNA) · only source for this CVE.
CVSS VectorVendor
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5Description PRE-NVD
AnalysisAI
FFC-DH peer validation in OpenSSL incorrectly accepts an attacker-supplied q (subgroup order) parameter instead of using the locally trusted value, undermining the cryptographic integrity of Diffie-Hellman key exchange. Affected branches span OpenSSL 3.0.x, 3.4.x, 3.5.x, 3.6.x, and 4.0.0, with patched releases issued across all five branches on 2026-06-09. With a CVSS score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) and no confirmed active exploitation or public proof-of-concept, this is a moderate-priority patch item rather than an emergency response trigger - though its broad reach across widely deployed OpenSSL branches warrants timely remediation.
Technical ContextAI
FFC-DH (Finite Field Cryptography Diffie-Hellman), standardized in NIST SP 800-56A, requires both parties to validate that a peer's public key belongs to the correct prime-order subgroup. This check depends on q, the subgroup order. Accepting an attacker-supplied q rather than the locally configured trusted value subverts this check, enabling small-subgroup or parameter substitution attacks. CWE-325 (Missing Cryptographic Step) precisely describes the root cause: a required validation step - enforcing the trusted group order against the peer's public key - is effectively skipped because the untrusted peer-supplied q replaces it. This flaw resides in OpenSSL's FFC-DH peer validation code path and affects any application invoking that path, whether through the high-level EVP API or the low-level DH interface, on versions confirmed via EUVD-2026-35487.
RemediationAI
Upgrade to the patched release corresponding to the installed OpenSSL branch: 4.0.1, 3.6.3, 3.5.7, 3.4.6, or 3.0.21, as detailed in the vendor advisory at https://openssl-library.org/news/secadv/20260609.txt. Ubuntu users should apply USN-8414-1 via the standard package manager. If an immediate upgrade is operationally infeasible, a compensating control is to disable all FFC-DH (DHE) cipher suites in the TLS configuration - for example, by removing DHE entries from the OpenSSL cipher string or SSL_CTX cipher list - forcing exclusive use of ECDHE key exchange; note this may break compatibility with legacy clients that only negotiate DHE. Applications using OpenSSL's low-level DH API directly should audit any code paths that accept peer-supplied group parameters and ensure locally trusted parameters are enforced rather than peer-derived values. Patch source commits are available at https://github.com/openssl/security/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02 and related commits in the openssl/security repository.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same weakness CWE-325 – Missing Cryptographic Step
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today