CVE-2026-42770: OpenSSL DHX Information Disclosure Flaw

CVE-2026-42770 Overview

CVE-2026-42770 is a cryptographic flaw in OpenSSL's handling of DHX (X9.42) Diffie-Hellman key exchange. When EVP_PKEY_derive_set_peer() processes a DHX peer key, the subgroup membership check uses the peer's q parameter instead of the local key's q. A malicious peer can supply forged domain parameters with a small prime q = r, allowing recovery of the victim's private key through a Lim–Lee small-subgroup-confinement attack. The flaw affects FIPS modules in OpenSSL 4.0, 3.6, 3.5, 3.4, and 3.0. The realistic attack surface is narrow, covering CMP deployments with long-lived RA/CA DHX keys and bespoke enterprise applications using static X9.42 keys [CWE-325].

Critical Impact

A malicious peer can recover a victim's DHX private key by repeatedly negotiating shared secrets confined to small subgroups and combining the leaked residues via the Chinese Remainder Theorem.

Affected Products

• OpenSSL FIPS module 4.0
• OpenSSL FIPS modules 3.6, 3.5, 3.4
• OpenSSL FIPS module 3.0

Discovery Timeline

• 2026-06-09 - CVE-2026-42770 published to NVD
• 2026-06-09 - OpenSSL security advisory released
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-42770

Vulnerability Analysis

The vulnerability resides in the DHX key exchange path within the OpenSSL provider implementation at providers/implementations/exchange/dh_exch.c. When the application calls EVP_PKEY_derive_set_peer() with an X9.42 peer key, OpenSSL validates that the peer's public value Y lies in the correct subgroup. The check Y^q ≡ 1 (mod p) is computed using the q value supplied by the peer rather than the q belonging to the local private key. The subsequent dh_match_params() comparison enforces matching p and g but skips q.

This gap allows a malicious peer to present the victim's own p and g parameters while substituting a forged small prime factor r of the cofactor (p−1)/q_local as its q. A public value Y of order r then passes every check. The derived shared secret takes only r distinct values, which directly leaks priv mod r. Repeating the exchange with different small-prime factors and combining the residues via the Chinese Remainder Theorem recovers the full static private key.

Root Cause

The root cause is improper validation of cryptographic domain parameters [CWE-325]. The function ossl_ffc_params_cmp() was invoked with ignore_q = 1, causing the routine to skip comparison of the q parameter between the local key and the peer key. The subgroup membership test therefore operated on attacker-controlled data, breaking the security invariant that defines safe Diffie-Hellman key exchange.

Attack Vector

Exploitation requires network access to a service that performs DHX key exchange using a long-lived static private key. CMP (Certificate Management Protocol) deployments with persistent RA/CA DHX keys are the principal attack surface. The attacker initiates multiple key exchanges, each presenting forged X9.42 parameters carrying a different small prime factor of the cofactor, and observes the resulting shared secrets to incrementally reconstruct the victim's private key.

// Patch in providers/implementations/exchange/dh_exch.c
static int dh_match_params(DH *priv, DH *peer)
{
    int ret;
    int ignore_q = 1;
    FFC_PARAMS *dhparams_priv = ossl_dh_get0_params(priv);
    FFC_PARAMS *dhparams_peer = ossl_dh_get0_params(peer);

    if (dhparams_priv != NULL && dhparams_priv->q != NULL)
        ignore_q = 0;
    ret = dhparams_priv != NULL
        && dhparams_peer != NULL
        && ossl_ffc_params_cmp(dhparams_priv, dhparams_peer, ignore_q);
    if (!ret)
        ERR_raise(ERR_LIB_PROV, PROV_R_MISMATCHING_DOMAIN_PARAMETERS);
    return ret;
}
// Source: https://github.com/openssl/openssl/commit/3da5a516cd2635a320ff748503db2cef7c4b0f02

The fix forces ignore_q = 0 whenever the local key carries a q value, ensuring q is compared between local and peer parameters and rejecting forged subgroup orders.

Detection Methods for CVE-2026-42770

Indicators of Compromise

• Repeated DHX key exchange attempts from the same network peer against a server holding a static X9.42 private key, particularly against CMP endpoints.
• DHX handshakes where the peer's advertised q parameter differs from the server's local q while p and g match.
• Unusual variance in derived shared secrets across sessions that share the same long-lived private key.

Detection Strategies

• Inventory all systems that load OpenSSL FIPS modules 3.0, 3.4, 3.5, 3.6, or 4.0 and identify those performing DHX (X9.42) key agreement.
• Inspect CMP server logs for high-frequency key-derivation failures or repeated session establishment from a single client identity.
• Audit applications that call EVP_PKEY_derive_set_peer() with DHX peer keys to verify they enforce domain-parameter equality at the application layer.

Monitoring Recommendations

• Alert on anomalous bursts of DHX handshake attempts targeting RA/CA or enterprise PKI services.
• Monitor for OpenSSL PROV_R_MISMATCHING_DOMAIN_PARAMETERS errors, which indicate post-patch rejection of malformed peer keys.
• Track outbound and inbound CMP traffic for source addresses initiating disproportionate numbers of sessions against signing infrastructure.

How to Mitigate CVE-2026-42770

Immediate Actions Required

• Upgrade affected OpenSSL FIPS modules to the patched versions referenced in the OpenSSL Security Advisory.
• Rotate any long-lived static DHX (X9.42) private keys used in CMP RA/CA roles or enterprise applications that may have been exposed.
• Audit CMP servers and bespoke applications relying on static X9.42 keys to confirm the patched provider is loaded.

Patch Information

The OpenSSL project addressed the vulnerability across multiple branches via commits 3da5a516, 3ddbb7ab, 5f452bba, 7fbfde76, and ca2237ab. The fix ensures dh_match_params() compares the local q against the peer's q whenever the local key defines one, preventing acceptance of forged subgroup parameters.

Workarounds

• Where patching is delayed, migrate from X9.42 DHX to ECDH or PQ key agreement schemes that do not rely on attacker-validated q parameters.
• Restrict CMP and similar protocol endpoints to authenticated peers via network ACLs to limit who can initiate DHX key exchange against static keys.
• Implement rate limiting on key-derivation operations to slow iterative small-subgroup probing.

# Verify the loaded OpenSSL FIPS provider version
openssl version -a
openssl list -providers -verbose

# Confirm patched module is active before resuming DHX-dependent services
openssl fipsinstall -module /path/to/fips.so -out fipsmodule.cnf -verify