---
id: CVE-2024-41996
title: >-
  Validating the order of the public keys in the Diffie-Hellman Key Agreement
  Protocol, when an approved safe prime is used, allows remote attackers (from
  the client side) to trigger unnecessarily expensive server-side DHE
  modular-exponent…
summary: >-
  Validating the order of the public keys in the Diffie-Hellman Key Agreement
  Protocol, when an approved safe prime is used, allows remote attackers (from
  the client side) to trigger unnecessarily expensive server-side DHE
  modular-exponent…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-295
published: '2024-08-26'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:41.927'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-41996'
references:
  - url: 'https://dheatattack.gitlab.io/details/'
    label: cve@mitre.org
  - url: 'https://dheatattack.gitlab.io/faq/'
    label: cve@mitre.org
  - url: 'https://gist.github.com/c0r0n3r/abccc14d4d96c0442f3a77fa5ca255d1'
    label: cve@mitre.org
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-089022.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-485750.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.01083
epssPercentile: 0.65012
ingestedAt: '2026-10-15T03:30:12.737Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2024-08-26T15:15:18.339789Z'
---

## Overview

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.