CVE-2024-41996 Denial of service in n/a
Remote attackers can cause server-side resource exhaustion via expensive DHE calculations if the server allows DHE and validates public key order.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-41996?
CVE-2024-41996 is a high-severity denial of service vulnerability in n/a, published on 26 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.
Weakness: CWE-295
Which versions are affected by CVE-2024-41996?
Linux distribution packages (13)
openssl-3 SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 3.0.8-150400.4.66.1 |
openssl-3 SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 3.0.8-150400.4.66.1 |
openssl-3 SUSE:Linux Enterprise Micro 5.3 | All versions | 3.0.8-150400.4.66.1 |
openssl-3 SUSE:Linux Enterprise Micro 5.4 | All versions | 3.0.8-150400.4.66.1 |
openssl-3 SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 3.0.8-150500.5.45.1 |
openssl-3 SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 3.1.4-150600.5.18.1 |
openssl-3 SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 3.0.8-150400.4.66.1 |
openssl-3 SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 3.0.8-150400.4.66.1 |
openssl-3 SUSE:Manager Proxy 4.3 | All versions | 3.0.8-150400.4.66.1 |
openssl-3 SUSE:Manager Server 4.3 | All versions | 3.0.8-150400.4.66.1 |
openssl-3 openSUSE:Leap 15.5 | All versions | 3.0.8-150500.5.45.1 |
openssl-3 openSUSE:Leap 15.6 | All versions | 3.1.4-150600.5.18.1 |
openssl-3 openSUSE:Tumbleweed | All versions | 3.1.4-14.1 |
How do I fix CVE-2024-41996?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-41996 being exploited?
There is no known exploitation of CVE-2024-41996 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2024-41996, GHSA-h964-f4gx-gw3x, OESA-2025-2325, OESA-2025-2326, OESA-2025-2327, OESA-2026-3419 and 4 more.