OpenSSL < 1.1.1n — DoS
A malformed TLS certificate can cause any application using OpenSSL to hang indefinitely, enabling remote denial of service against servers that process client certificates.
An attacker can send a malformed TLS certificate to any server that processes certificates using a vulnerable OpenSSL version. The server process will enter an infinite loop consuming 100% of a CPU core and never completing the handshake, effectively rendering the service unavailable. No authentication is required — the attack is triggered before any authentication occurs.
OpenSSL's BN_mod_sqrt() function, used during TLS certificate parsing, can be triggered into an infinite loop by a certificate containing an elliptic curve parameter with a specially crafted prime number. Any server that parses TLS certificates — including those accepting client certificates, or parsing certificates during TLS handshake — is vulnerable. OpenSSL is embedded in countless applications including Apache httpd, nginx, Python, Node.js, and many others.
Probably yes if any of these apply:
Affected OS versions
TLS denial-of-service vulnerabilities are particularly impactful for internet-facing services where any unauthenticated client can initiate a TLS handshake. A single attacker with a low-bandwidth connection can sustain a CPU exhaustion attack against a vulnerable server.
Manual remediation steps
⏱ 20–40 minutesStep 1 — Check OpenSSL Version
# Check standalone OpenSSL
openssl version 2>$null
# Check Git for Windows bundled OpenSSL
$gitOpenssl = (Get-Command git -ErrorAction SilentlyContinue)?.Source -replace 'git.exe', 'openssl.exe'
if ($gitOpenssl -and (Test-Path $gitOpenssl)) { & $gitOpenssl version }
# Check Python bundled OpenSSL
python -c "import ssl; print(ssl.OPENSSL_VERSION)" 2>$null
Step 2 — Update OpenSSL
Via Git for Windows
Update Git for Windows to 2.36.0 or later which bundles OpenSSL 1.1.1n+
Via Python
Update Python — newer Python versions bundle updated OpenSSL
Standalone OpenSSL
Verification
openssl version
# Must show 1.1.1n, 3.0.2, or later
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References