CVE-2006-2940 in OpenSSL
Summary
by MITRE
OpenSSL 0.9.7 before 0.9.7l, 0.9.8 before 0.9.8d, and earlier versions allows attackers to cause a denial of service (CPU consumption) via parasitic public keys with large (1) "public exponent" or (2) "public modulus" values in X.509 certificates that require extra time to process when using RSA signature verification.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/23/2026
This vulnerability affects OpenSSL versions prior to 0.9.7l and 0.9.8d, creating a significant denial of service risk through carefully crafted X.509 certificates containing malicious RSA public keys. The flaw exploits the computational complexity inherent in RSA signature verification processes when encountering certificates with unusually large public exponents or modulus values. Attackers can manipulate certificate structures to force the verification algorithm into computationally expensive operations that consume excessive CPU resources. The vulnerability specifically targets the RSA public key processing logic where the verification routine must handle mathematical operations with extremely large numbers, causing disproportionate processing time relative to normal certificate validation. This creates a resource exhaustion scenario where legitimate services become unavailable due to the excessive computational demands imposed by malicious certificate processing.
The technical implementation of this vulnerability stems from the mathematical properties of RSA cryptography and how OpenSSL handles public key validation. When processing X.509 certificates, the system performs modular exponentiation operations using the public exponent and modulus values. Normal RSA keys typically use small public exponents like 65537, but malicious certificates can contain exponents or modulus values that are orders of magnitude larger. The computational complexity of modular exponentiation increases exponentially with the size of the operands, meaning that a certificate with a 1000-bit modulus will require significantly more processing time than a standard 2048-bit certificate. This mathematical characteristic becomes exploitable when the verification process must handle these oversized values without proper bounds checking or optimization.
The operational impact of this vulnerability extends beyond simple service disruption to potentially enable sophisticated attack campaigns targeting critical infrastructure. Systems that regularly process X.509 certificates from untrusted sources, such as web servers validating client certificates, email servers processing signed messages, or certificate authority systems performing validation, become vulnerable to this attack vector. The attack can be executed through various means including SSL/TLS handshake failures, certificate validation requests, or any process requiring RSA signature verification. The resource consumption pattern makes this particularly dangerous for systems with limited computational resources or those operating under strict performance requirements. Network services that rely on certificate validation for authentication and encryption can experience complete service unavailability, potentially leading to extended downtime and significant operational disruption.
Mitigation strategies for this vulnerability focus on both immediate patching and operational hardening measures. The primary solution involves upgrading to OpenSSL versions 0.9.7l or 0.9.8d and later, which include proper bounds checking and optimization for handling large RSA values. Organizations should implement certificate validation policies that reject certificates with suspiciously large public exponents or modulus values, establishing reasonable size limits based on industry standards. Network monitoring systems should be configured to detect unusual CPU consumption patterns during certificate processing, enabling early detection of potential attacks. Additionally, implementing rate limiting and circuit breaker patterns in certificate validation processes can prevent single malicious certificates from consuming excessive resources. The vulnerability aligns with CWE-1321, which addresses improper handling of large values in cryptographic operations, and represents a specific instance of the broader ATT&CK technique T1499.004 related to network denial of service attacks. Organizations should also consider implementing certificate pinning mechanisms and validating certificate chains against trusted sources to reduce exposure to malicious certificate content.