What’s Vulnerable › Vulnerabilities
CVE-2026-81019: wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
- Severity: high (CVSS 7.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-28 · updated 2026-09-29
- Weakness: CWE-323
Description
wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
Affected products
- wolfSSL Wolfprovider: before 1.2.2 — fixed in 1.2.2
How to fix
Upgrade to a fixed version: wolfSSL Wolfprovider 1.2.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-81019 or the next vulnerability affects your stack