JLSEC-2026-241

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-241.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-241.json

JSON Data

https://api.test.osv.dev/v1/vulns/JLSEC-2026-241

Upstream

CVE-2023-3817

EUVD-2023-44449

GHSA-c945-cqj5-wfv6

Published

2026-04-27T18:33:55.942Z

Modified

2026-04-27T20:32:30.631037336Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary:...

Details

Issue summary: Checking excessively long DH keys or parameters may be very slow.

Impact summary: Applications that use the functions DHcheck(), DHcheckex() or EVPPKEYparamcheck() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service.

The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p.

An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack.

The function DHcheck() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DHcheckex() and EVPPKEYparamcheck().

Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option.

The OpenSSL SSL/TLS implementation is not affected by this issue.

The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.

Database specific

{
    "sources": [
        {
            "imported": "2026-04-27T16:32:45.271Z",
            "modified": "2025-05-05T16:15:47.343Z",
            "id": "CVE-2023-3817",
            "published": "2023-07-31T16:15:10.497Z",
            "database_specific": {
                "status": "Modified"
            },
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3817",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2023-3817"
        },
        {
            "imported": "2026-04-27T16:35:25.732Z",
            "modified": "2024-10-14T15:31:49Z",
            "id": "GHSA-c945-cqj5-wfv6",
            "published": "2023-07-31T18:30:22Z",
            "html_url": "https://github.com/advisories/GHSA-c945-cqj5-wfv6",
            "url": "https://api.github.com/advisories/GHSA-c945-cqj5-wfv6"
        },
        {
            "imported": "2026-04-27T16:33:16.722Z",
            "modified": "2025-05-05T15:53:49Z",
            "id": "EUVD-2023-44449",
            "published": "2023-07-31T15:34:13Z",
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44449",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2023-44449"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Affected packages

Julia / OpenSSL_jll

Package

Name: OpenSSL_jll
Purl: pkg:julia/OpenSSL_jll?uuid=458c3c95-2e84-50aa-8efc-19380b2a3a95

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.22+0

Introduced

3.0.8+0

Fixed

3.0.10+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-241.json"

Julia / Openresty_jll

Package

Name: Openresty_jll
Purl: pkg:julia/Openresty_jll?uuid=87da34d4-7b1b-5a94-8376-8cb65bf3132c

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.27.1+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-241.json"