wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
"}],"value":"wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-323","description":"CWE-323 Reusing a Nonce, Key Pair in Encryption","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-28T14:42:01.361Z","orgId":"50d2cd11-d01a-48ed-9441-5bfce9d63b27","shortName":"wolfSSL"},"references":[{"name":"wolfSSL security advisories","url":"https://www.wolfssl.com/docs/security-vulnerabilities/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Upgrade to wolfProvider 1.2.2, which increments the explicit nonce after each record. As an interim mitigation use AES-CCM or TLS 1.3 instead of TLS 1.2 / DTLS 1.2 AES-GCM.
"}],"value":"Upgrade to wolfProvider 1.2.2, which increments the explicit nonce after each record. As an interim mitigation use AES-CCM or TLS 1.3 instead of TLS 1.2 / DTLS 1.2 AES-GCM."}],"source":{"discovery":"UNKNOWN"},"title":"wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"50d2cd11-d01a-48ed-9441-5bfce9d63b27","assignerShortName":"wolfSSL","cveId":"CVE-2026-81019","datePublished":"2026-08-28T14:42:01.361Z","dateReserved":"2026-08-26T14:40:10.441Z","dateUpdated":"2026-08-28T18:22:34.803Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-28 16:18:28","lastModifiedDate":"2026-09-29 19:11:58","problem_types":["CWE-323","CWE-323 CWE-323 Reusing a Nonce, Key Pair in Encryption"],"metrics":{"cvssMetricV31":[{"source":"facts@wolfssl.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-28T18:22:24.955188Z","id":"CVE-2026-81019","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wolfssl:wolfprovider:*:*:*:*:*:*:*:*","versionEndExcluding":"1.2.2","matchCriteriaId":"BBD3B5EA-A36C-4EF9-84FE-828D7C8FE554"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"81019","Ordinal":"1","Title":"wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.","CVE":"CVE-2026-81019","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"81019","Ordinal":"1","NoteData":"wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.","Type":"Description","Title":"wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1."}]}}}