EUVD-2026-39493
GHSA-q4q5-jx42-4xp9
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and high complexity required to accumulate over 64 GiB in one session; only partial confidentiality impact via keystream reuse, no integrity or availability impact.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery.
AnalysisAI
Keystream reuse in wolfSSL's streaming AES-GCM API exposes ciphertext to partial plaintext recovery when a single session accumulates more than 64 GiB of data, violating NIST SP 800-38D counter limits due to unguarded internal counter wrap. All wolfSSL versions are affected per wildcard CPE (cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*), with the flaw present in both AES-GCM and AES-CCM streaming paths. Exploitation is constrained to local access with low privileges, high attack complexity, and the operationally unusual prerequisite of processing tens of gigabytes in a single uninterrupted streaming session; no public exploit identified at time of analysis.
Technical ContextAI
wolfSSL (cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*) is a lightweight embedded SSL/TLS cryptographic library widely used in IoT, automotive, and resource-constrained systems. The affected code is in the streaming AES-GCM functions wc_AesGcmEncryptUpdate and wc_AesGcmDecryptUpdate in wolfcrypt/src/aes.c, along with AES-CCM streaming counterparts. AES-GCM derives keystream by incrementing a 32-bit block counter; per NIST SP 800-38D section 5.2.1.1 the maximum ciphertext before counter exhaustion is 2^32 − 2 blocks (~64 GiB). wolfSSL's streaming APIs accumulated cumulative sizes in word32 (32-bit unsigned integer) byte-count variables (aes->cSz and aes->aSz) without bounds checking, meaning sessions could silently overflow these counters and permit the underlying GCM block counter to wrap. Counter wrap causes keystream blocks to be reused across ciphertext. Per CWE-323 (Reusing a Nonce/Key Pair in Encryption), an observer of two ciphertexts encrypted under the same keystream can XOR them to obtain the XOR of the two plaintexts, enabling partial plaintext recovery. The fix in PR #10709 adds explicit overflow guards returning AES_GCM_OVERFLOW_E or AES_CCM_OVERFLOW_E before any counter wrap can occur, and also addresses the AES-CCM nonce-length edge case where the B[] counter field cannot represent inSz.
RemediationAI
Apply the fix from wolfSSL GitHub PR #10709 (https://github.com/wolfSSL/wolfssl/pull/10709), which adds counter-overflow guards to both AES-GCM and AES-CCM streaming encrypt and decrypt paths. An exact released version containing this fix is not independently confirmed from the provided data - monitor https://www.wolfssl.com/docs/security-vulnerabilities/ for the official fixed-release announcement. Until a versioned release is deployed, applications using wolfSSL's raw streaming AES-GCM API should enforce an application-level check rejecting any single streaming session whose cumulative data size approaches 4 GiB (the word32 byte-count boundary) or 64 GiB (the NIST counter limit); this restriction has no functional side-effect since NIST SP 800-38D prohibits such sizes regardless. Applications using wolfSSL exclusively through its TLS handshake and record-layer API are not exposed and require no action, as TLS record sizes are far below the trigger threshold.
wolfSSL prior to version 3.12.2 provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange i
A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting
wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or tra
In wolfSSL before 5.5.1, malicious clients can cause a buffer overflow during a TLS 1.3 handshake. Rated high severity (
An issue was discovered in wolfSSL before 5.5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
wolfSSL 4.3.0 has mulmod code in wc_ecc_mulmod_ex in ecc.c that does not properly resist timing side-channel attacks. Ra
In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data wh
An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Rated high severity (CVSS 7.0).
wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in t
wolfSSL (formerly CyaSSL) before 3.6.8 does not properly handle faults associated with the Chinese Remainder Theorem (CR
An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is e
wolfSSL 4.6.x through 4.7.x before 4.8.0 does not produce a failure outcome when the serial number in an OCSP request di
Same weakness CWE-323 – Reusing a Nonce, Key Pair in Encryption
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today