CVE-2023-50981 Denial of service in n/a

High 7.5 Published 18 Dec 2023 Updated 7 May 2025

Attackers can cause a denial of service via infinite loop in Crypto++ by submitting crafted DER public-key data.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-50981?

CVE-2023-50981 is a high-severity denial of service vulnerability in n/a, published on 18 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (infinite loop) via crafted DER public-key data associated with squared odd numbers, such as the square of 268995137513890432434389773128616504853.

Weakness: CWE-835

Which versions are affected by CVE-2023-50981?

It affects 1 product.

Linux distribution packages (4)

`libcryptopp` SUSE:Linux Enterprise Module for Basesystem 15 SP5	All versions	`8.6.0-150400.3.6.1`
`libcryptopp` SUSE:Linux Enterprise Real Time 15 SP4	All versions	`8.6.0-150400.3.6.1`
`libcryptopp` openSUSE:Leap 15.5	All versions	`8.6.0-150400.3.6.1`
`libcryptopp` openSUSE:Tumbleweed	All versions	`8.9.0-2.1`

Products include Cryptopp Crypto\+\+.

How do I fix CVE-2023-50981?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-50981 being exploited?

There is no known exploitation of CVE-2023-50981 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2023-50981, GHSA-wrgh-jm24-7hv6, JLSEC-2026-1273, SUSE-SU-2024:0157-1, UBUNTU-CVE-2023-50981, openSUSE-SU-2024:13550-1.