diff -Naur a/crypto/dh/dh_check.c b/crypto/dh/dh_check.c --- a/crypto/dh/dh_check.c 2023-07-25 19:25:47.628975754 +0800 +++ b/crypto/dh/dh_check.c 2023-07-25 19:22:41.934923083 +0800 @@ -101,6 +101,12 @@ BN_CTX *ctx = NULL; BIGNUM *t1 = NULL, *t2 = NULL; + /* Don't do any checks at all with an excessively large modulus */ + if (BN_num_bits(dh->p) > OPENSSL_DH_CHECK_MAX_MODULUS_BITS) { + DHerr(DH_F_DH_CHECK, DH_R_MODULUS_TOO_LARGE); + return 0; + } + if (!DH_check_params(dh, ret)) return 0; diff -Naur a/crypto/dh/dh_err.c b/crypto/dh/dh_err.c --- a/crypto/dh/dh_err.c 2023-07-25 19:25:47.628975754 +0800 +++ b/crypto/dh/dh_err.c 2023-07-25 19:22:41.934923083 +0800 @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -18,6 +18,7 @@ {ERR_PACK(ERR_LIB_DH, DH_F_DHPARAMS_PRINT_FP, 0), "DHparams_print_fp"}, {ERR_PACK(ERR_LIB_DH, DH_F_DH_BUILTIN_GENPARAMS, 0), "dh_builtin_genparams"}, + {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK, 0), "DH_check"}, {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_EX, 0), "DH_check_ex"}, {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_PARAMS_EX, 0), "DH_check_params_ex"}, {ERR_PACK(ERR_LIB_DH, DH_F_DH_CHECK_PUB_KEY_EX, 0), "DH_check_pub_key_ex"}, diff -Naur a/crypto/err/openssl.txt b/crypto/err/openssl.txt --- a/crypto/err/openssl.txt 2023-07-25 19:25:47.632975799 +0800 +++ b/crypto/err/openssl.txt 2023-07-25 19:22:41.938923126 +0800 @@ -402,6 +402,7 @@ DH_F_COMPUTE_KEY:102:compute_key DH_F_DHPARAMS_PRINT_FP:101:DHparams_print_fp DH_F_DH_BUILTIN_GENPARAMS:106:dh_builtin_genparams +DH_F_DH_CHECK:126:DH_check DH_F_DH_CHECK_EX:121:DH_check_ex DH_F_DH_CHECK_PARAMS_EX:122:DH_check_params_ex DH_F_DH_CHECK_PUB_KEY_EX:123:DH_check_pub_key_ex diff -Naur a/include/openssl/dherr.h b/include/openssl/dherr.h --- a/include/openssl/dherr.h 2023-07-25 19:25:47.668976201 +0800 +++ b/include/openssl/dherr.h 2023-07-25 19:22:41.978923558 +0800 @@ -1,6 +1,6 @@ /* * Generated by util/mkerr.pl DO NOT EDIT - * Copyright 1995-2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the OpenSSL license (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -31,6 +31,7 @@ # define DH_F_DHPARAMS_PRINT_FP 101 # define DH_F_DH_BUILTIN_GENPARAMS 106 # define DH_F_DH_CHECK_EX 121 +# define DH_F_DH_CHECK 126 # define DH_F_DH_CHECK_PARAMS_EX 122 # define DH_F_DH_CHECK_PUB_KEY_EX 123 # define DH_F_DH_CMS_DECRYPT 114 diff -Naur a/include/openssl/dh.h b/include/openssl/dh.h --- a/include/openssl/dh.h 2023-07-25 19:25:47.668976201 +0800 +++ b/include/openssl/dh.h 2023-07-25 19:22:41.978923558 +0800 @@ -29,6 +29,9 @@ # ifndef OPENSSL_DH_MAX_MODULUS_BITS # define OPENSSL_DH_MAX_MODULUS_BITS 10000 # endif +# ifndef OPENSSL_DH_CHECK_MAX_MODULUS_BITS +# define OPENSSL_DH_CHECK_MAX_MODULUS_BITS 32768 +# endif # define OPENSSL_DH_FIPS_MIN_MODULUS_BITS 1024