CVE-2026-42770
FFC-DH Peer Validation Uses Attacker-Supplied q
Description
Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, 3.1.2 and 3.0 are affected by this issue.
INFO
Published Date :
June 9, 2026, 5:17 p.m.
Last Modified :
July 23, 2026, 8:10 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | LOW | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Update OpenSSL to a patched version.
- Verify DHX peer key handling.
- Review key exchange protocol security.
Public PoC/Exploit Available at Github
CVE-2026-42770 has a 3 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-42770.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-42770 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-42770
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Tooling for generating and manipulating Software Bill of Materials (SBOMs) for OpenVox projects.
Ruby
Tracking CVEs discovered by AI systems — Anthropic, OpenAI, Google Big Sleep, Microsoft MDASH, DepthFirst
Tracking Vulnerabilities That Appear to be Credited to the Anthropic Research Team
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-42770 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-42770 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: OpenSSL, Description: Resumen del problema: Cuando se llama a EVP_PKEY_derive_set_peer() con una clave de par DHX (X9.42), la clave de par no se verifica correctamente para la pertenencia al subgrupo. Resumen del impacto: Un par malicioso que presenta una clave X9.42 que contiene los parámetros p y g de la víctima, una q forjada = r (un pequeño factor primo del cofactor (p?1)/q_local), y un valor público Y de orden r puede recuperar la clave privada de la víctima después de un pequeño número de intentos de intercambio de claves. Cuando se llama a EVP_PKEY_derive_set_peer() con una clave de par DHX (X9.42), la verificación de pertenencia al subgrupo Y^q ? 1 (mod p) se realiza utilizando el propio parámetro q del par, no la q de la clave local. Los parámetros de dominio del par se comparan entonces con los parámetros de dominio de la clave privada, pero el valor de q no se compara. Un par malicioso que presenta una clave X9.42 que contiene la p, g de la víctima, una q forjada = r (un pequeño factor primo del cofactor), y un valor público Y de orden r pasa todas las verificaciones. El secreto compartido toma entonces solo r valores distintos, filtrando priv mod r. Repitiendo para cada factor primo pequeño del cofactor y combinando mediante CRT se recupera la clave privada completa (ataque Lim-Lee / de confinamiento de subgrupo pequeño). La superficie de ataque realista es estrecha: principalmente despliegues de CMP con claves DHX de RA/CA de larga duración y aplicaciones empresariales o gubernamentales a medida que utilizan claves estáticas DHX X9.42 con protocolos interactivos y, por lo tanto, a este problema se le asignó una severidad Baja. Los módulos FIPS en 4.0, 3.6, 3.5, 3.4 y 3.0 se ven afectados por este problema. -
CVE Modified by [email protected]
Jul. 20, 2026
Action Type Old Value New Value Changed Description Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue. Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, 3.1.2 and 3.0 are affected by this issue. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'OpenSSL', 'product': 'OpenSSL', 'versions': [{'status': 'affected', 'version': '4.0.0', 'lessThan': '4.0.1', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.6.0', 'lessThan': '3.6.3', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.5.0', 'lessThan': '3.5.7', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.4.0', 'lessThan': '3.4.6', 'versionType': 'semver'}, {'status': 'affected', 'version': '3.0.0', 'lessThan': '3.0.21', 'versionType': 'semver'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-42770', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-09T19:34:57.693097Z'} -
Initial Analysis by [email protected]
Jun. 16, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.21 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.6 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.7 *cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3 *cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:* Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02 Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2 Types: Patch Added Reference Type OpenSSL Software Foundation: https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070 Types: Patch Added Reference Type OpenSSL Software Foundation: https://openssl-library.org/news/secadv/20260609.txt Types: Vendor Advisory -
CVE Modified by [email protected]
Jun. 10, 2026
Action Type Old Value New Value Added Reference https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02 Added Reference https://github.com/openssl/openssl/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb Added Reference https://github.com/openssl/openssl/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c Added Reference https://github.com/openssl/openssl/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2 Added Reference https://github.com/openssl/openssl/commit/ca2237ab5615641b662183b077f62c08d75e8070 Removed Reference https://github.com/openssl/security/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02 Removed Reference https://github.com/openssl/security/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb Removed Reference https://github.com/openssl/security/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c Removed Reference https://github.com/openssl/security/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2 Removed Reference https://github.com/openssl/security/commit/ca2237ab5615641b662183b077f62c08d75e8070 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 09, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N -
New CVE Received by [email protected]
Jun. 09, 2026
Action Type Old Value New Value Added Description Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain parameters are then matched against the domain parameters of the private key, but the value of q is not compared. A malicious peer who presents an X9.42 key carrying the victim's p, g, a forged q = r (a small prime factor of the cofactor), and a public value Y of order r passes all checks. The shared secret then takes only r distinct values, leaking priv mod r. Repeating for each small-prime factor of the cofactor and combining via CRT recovers the full private key (Lim–Lee / small-subgroup-confinement attack). The realistic attack surface is narrow: principally CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise or government applications using X9.42 DHX static keys with interactive protocols and therefore this issue was assigned Low severity. The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are affected by this issue. Added CWE CWE-325 Added Reference https://github.com/openssl/security/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02 Added Reference https://github.com/openssl/security/commit/3ddbb7ab50bd93dfc59cbe08e269a67605aeebdb Added Reference https://github.com/openssl/security/commit/5f452bba2c681423d8fcffd120a19b757ee42e3c Added Reference https://github.com/openssl/security/commit/7fbfde7677ed8808828bf00ff01c937ca04bdda2 Added Reference https://github.com/openssl/security/commit/ca2237ab5615641b662183b077f62c08d75e8070 Added Reference https://openssl-library.org/news/secadv/20260609.txt