Vulnerability · Published Aug 28, 2026 · Assigned by wolfSSL

CVE-2026-81019wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record

High 7.4

In plain English

A high-severity security flaw in wolfProvider from wolfSSL Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.4%top 67.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

Affected products (as reported)

Vendor	Product	Versions
wolfSSL Inc.	wolfProvider	0 – through 1.2.1

Weakness: CWE-323 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

wolfSSL security advisories