EUVD-2026-67736
GHSA-pq4j-x8cj-rwpc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-observable passive attack (AV:N); AC:H because multiple records must be captured; no authentication or interaction needed; no availability impact.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
AnalysisAI
Nonce reuse in wolfProvider before 1.2.2 completely breaks AES-GCM confidentiality and integrity guarantees for every TLS 1.2 and DTLS 1.2 connection using that cipher suite. Because the 8-byte explicit nonce is set once at key establishment and never incremented, every record in a session is encrypted under an identical (key, nonce) pair - the classical 'forbidden attack' condition where XORing two ciphertexts yields the XOR of the plaintexts, and the GHASH authentication key can be algebraically recovered to enable tag forgery. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses wolfProvider (before 1.2.2) as its OpenSSL 3.x provider AND has negotiated TLS 1.2 or DTLS 1.2 with an AES-GCM cipher suite (e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 or similar). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.4 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N accurately reflects a network-reachable flaw requiring no privileges but elevated complexity - the AC:H acknowledges that the attacker must passively capture sufficient ciphertext records from a target session before exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is upgrading wolfProvider to version 1.2.2 or later, which corrects the nonce counter logic so the explicit IV is properly incremented for each TLS record. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all systems running wolfProvider and identify which use AES-GCM with TLS 1.2 or DTLS 1.2; prioritize business-critical systems using this configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-323 – Reusing a Nonce, Key Pair in Encryption
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today