CVE-2026-81019

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.wolfssl.com/docs/security-vulnerabilities/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wolfssl:wolfprovider:*:*:*:*:*:*:*:*

History

29 Sep 2026, 19:11

Type	Values Removed	Values Added
References	~~() https://www.wolfssl.com/docs/security-vulnerabilities/ -~~	() https://www.wolfssl.com/docs/security-vulnerabilities/ - Vendor Advisory
CPE		cpe:2.3:a:wolfssl:wolfprovider::::::::
First Time		Wolfssl wolfprovider Wolfssl

Information

Published : 2026-08-28 16:18

Updated : 2026-09-29 19:11

NVD link : CVE-2026-81019

Mitre link : CVE-2026-81019

CVE.ORG link : CVE-2026-81019

JSON object : View

Products Affected

wolfssl

wolfprovider

CWE

CWE-323

Reusing a Nonce, Key Pair in Encryption

{"id": "CVE-2026-81019", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81019", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-28T18:22:24.955188Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "facts@wolfssl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "facts@wolfssl.com", "affectedData": [{"repo": "https://github.com/wolfSSL/wolfProvider", "vendor": "wolfSSL Inc.", "product": "wolfProvider", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "1.2.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-28T16:18:28.757", "references": [{"url": "https://www.wolfssl.com/docs/security-vulnerabilities/", "tags": ["Vendor Advisory"], "source": "facts@wolfssl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "facts@wolfssl.com", "description": [{"lang": "en", "value": "CWE-323"}]}], "descriptions": [{"lang": "en", "value": "wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected."}], "lastModified": "2026-09-29T19:11:58.053", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wolfssl:wolfprovider:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBD3B5EA-A36C-4EF9-84FE-828D7C8FE554", "versionEndExcluding": "1.2.2"}], "operator": "OR"}]}], "sourceIdentifier": "facts@wolfssl.com"}