High 7.5Published May 4, 2017

CVE-2017-3730In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a…

Updated under an hour ago (Nov 2, 2026, 1:40 AM ET)

Does this affect you?

It affects openssl and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for openssl Exploited in the last 30 days

In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.

CVSS: 7.5 HIGH (v3.0, NVD)CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Modified
Record last updated: Jun 16, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

openssl openssl openssl:openssl	1.1.0; 1.1.0a; 1.1.0b; 1.1.0c	NVD
oracle agile_engineering_data_management oracle:agile_engineering_data_management	6.1.3; 6.2.0	NVD
oracle communications_application_session_controller oracle:communications_application_session_controller	3.7.1; 3.8.0	NVD
oracle communications_eagle_lnp_application_processor oracle:communications_eagle_lnp_application_processor	10.0; 10.1; 10.2	NVD
oracle communications_operations_monitor oracle:communications_operations_monitor	3.4; 4.0	NVD
oracle jd_edwards_enterpriseone_tools oracle:jd_edwards_enterpriseone_tools	9.2	NVD
oracle jd_edwards_world_security oracle:jd_edwards_world_security	a9.1; a9.2; a9.3; a9.4	NVD

References

References

http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html	patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html	patch
http://www.securityfocus.com/bid/95812	broken-link, third-party-advisory, vdb-entry
http://www.securitytracker.com/id/1037717	third-party-advisory, vdb-entry
https://github.com/openssl/openssl/commit/efbe126e3ebb9123ac9d058aa2bb044261342aaa	patch, third-party-advisory
https://security.gentoo.org/glsa/201702-07	third-party-advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03838en_us	third-party-advisory
https://www.exploit-db.com/exploits/41192/	exploit, third-party-advisory, vdb-entry
https://www.openssl.org/news/secadv/20170126.txt	patch, vendor-advisory
https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.