CVE-2022-40735

Estado: ModificadaAlta (7.5)—

The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that "(appropriately) short exponents" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys.

Leer descripción completaMostrar menos

The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 2.51%
Percentil entre todas las CVEs puntuadas: 84
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Diffie-hellman KEY Exchange Project — Diffie-hellman KEY Exchange

CWE

CWE-400

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-40735",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-11-14T23:15:11.423",
  "references": [
    {
      "url": "https://dheatattack.gitlab.io/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gist.github.com/c0r0n3r/9455ddcab985c50fd1912eabf26e058b",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/mozilla/ssl-config-generator/issues/162",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://ieeexplore.ieee.org/document/10374117",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://link.springer.com/content/pdf/10.1007/3-540-68339-9_29.pdf",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf",
      "tags": [
        "Technical Description",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://raw.githubusercontent.com/CVEProject/cvelist/9d7fbbcabd3f44cfedc9e8807757d31ece85a2c6/2022/40xxx/CVE-2022-40735.json",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol/links/546c144f0cf20dedafd53e7e/Security-Issues-in-the-Diffie-Hellman-Key-Agreement-Protocol.pdf",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.rfc-editor.org/rfc/rfc3526",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.rfc-editor.org/rfc/rfc4419",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.rfc-editor.org/rfc/rfc5114#section-4",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.rfc-editor.org/rfc/rfc7919#section-5.2",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://dheatattack.gitlab.io/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://gist.github.com/c0r0n3r/9455ddcab985c50fd1912eabf26e058b",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/mozilla/ssl-config-generator/issues/162",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://ieeexplore.ieee.org/document/10374117",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://link.springer.com/content/pdf/10.1007/3-540-68339-9_29.pdf",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf",
      "tags": [
        "Technical Description",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://raw.githubusercontent.com/CVEProject/cvelist/9d7fbbcabd3f44cfedc9e8807757d31ece85a2c6/2022/40xxx/CVE-2022-40735.json",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.researchgate.net/profile/Anton-Stiglic-2/publication/2401745_Security_Issues_in_the_Diffie-Hellman_Key_Agreement_Protocol/links/546c144f0cf20dedafd53e7e/Security-Issues-in-the-Diffie-Hellman-Key-Agreement-Protocol.pdf",
      "tags": [
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.rfc-editor.org/rfc/rfc3526",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.rfc-editor.org/rfc/rfc4419",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.rfc-editor.org/rfc/rfc5114#section-4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.rfc-editor.org/rfc/rfc7919#section-5.2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that \"(appropriately) short exponents\" can be used when there are adequate subgroup constraints, and these short exponents can lead to less expensive calculations than for long exponents. This issue is different from CVE-2002-20001 because it is based on an observation about exponent size, rather than an observation about numbers that are not public keys. The specific situations in which calculation expense would constitute a server-side vulnerability depend on the protocol (e.g., TLS, SSH, or IKE) and the DHE implementation details. In general, there might be an availability concern because of server-side resource consumption from DHE modular-exponentiation calculations. Finally, it is possible for an attacker to exploit this vulnerability and CVE-2002-20001 together."
    },
    {
      "lang": "es",
      "value": "Diffie-Hellman Key Agreement Protocol permite el uso de exponentes largos que posiblemente hacen que ciertos cálculos sean innecesariamente costosos, porque el artículo de van Oorschot y Wiener de 1996 encontró que se pueden usar \"exponentes (apropiadamente) cortos\" cuando existen restricciones de subgrupo adecuadas, y estos exponentes cortos pueden conducir a cálculos menos costosos que los de exponentes largos. Este problema es diferente de CVE-2002-20001, porque se basa en una observación sobre el tamaño del exponente, en lugar de una observación sobre números que no son claves públicas. Las situaciones específicas en las que el gasto de cálculo constituiría una vulnerabilidad del lado del servidor dependen del protocolo (por ejemplo, TLS, SSH o IKE) y los detalles de implementación de DHE. En general, puede haber un problema de disponibilidad debido al consumo de recursos del lado del servidor a partir de los cálculos de exponenciación modular de DHE. Finalmente, es posible que un atacante aproveche esta vulnerabilidad y CVE-2002-20001 juntos."
    }
  ],
  "lastModified": "2026-06-17T05:01:56.980",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:diffie-hellman_key_exchange_project:diffie-hellman_key_exchange:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43F56DA8-0635-41E8-B91C-485695B587AD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}