Wolfssl Inc
Monthly
AES-GCM nonce reuse in wolfEngine before 1.4.1 allows a network-positioned passive adversary to fully recover encrypted plaintext and forge authentication tags across all TLS 1.2 and DTLS 1.2 sessions. The 8-byte explicit nonce is generated once at TLS write-key setup and never incremented per record, meaning every GCM record within a connection shares an identical (key, nonce) pair - a catastrophic misuse of authenticated encryption. AES-CCM cipher suites, TLS 1.3, and non-TLS uses of AES-GCM are explicitly unaffected; no public exploit identified at time of analysis.
Nonce reuse in wolfProvider before 1.2.2 completely breaks AES-GCM confidentiality and integrity guarantees for every TLS 1.2 and DTLS 1.2 connection using that cipher suite. Because the 8-byte explicit nonce is set once at key establishment and never incremented, every record in a session is encrypted under an identical (key, nonce) pair - the classical 'forbidden attack' condition where XORing two ciphertexts yields the XOR of the plaintexts, and the GHASH authentication key can be algebraically recovered to enable tag forgery. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the attack is well-understood cryptography with no special tooling required beyond captured traffic.
Nonce reuse in wolfEngine's AES-CCM implementation for TLS 1.2 and DTLS 1.2 allows a network-positioned adversary to recover plaintext across records and forge authentication tags within a session. The root defect is that wolfEngine reads the explicit CCM nonce from the uninitialized record input buffer rather than deriving it from the TLS sequence number in the Additional Authenticated Data, producing a constant nonce for every record under the same key. Exposure is sharply constrained: AES-CCM cipher suites must be explicitly selected (non-default), only wolfEngine is affected (wolfProvider is not), and TLS 1.3 is entirely outside scope. No public exploit or CISA KEV listing exists at time of analysis; the vendor-released fix is wolfEngine 1.4.1.
Stack buffer overflow in wolfSSL 5.8.4's ECH (Encrypted Client Hello) implementation allows remote attackers to crash TLS clients or achieve code execution by sending a maliciously crafted ECH configuration. The vulnerability affects clients that have explicitly enabled ECH support, which is disabled by default. An attacker controlling a TLS server can exploit this remotely without authentication or user interaction.
CVE-2026-3503 is a security vulnerability (CVSS 4.3) that allows a physical attacker. Remediation should follow standard vulnerability management procedures.
AES-GCM nonce reuse in wolfEngine before 1.4.1 allows a network-positioned passive adversary to fully recover encrypted plaintext and forge authentication tags across all TLS 1.2 and DTLS 1.2 sessions. The 8-byte explicit nonce is generated once at TLS write-key setup and never incremented per record, meaning every GCM record within a connection shares an identical (key, nonce) pair - a catastrophic misuse of authenticated encryption. AES-CCM cipher suites, TLS 1.3, and non-TLS uses of AES-GCM are explicitly unaffected; no public exploit identified at time of analysis.
Nonce reuse in wolfProvider before 1.2.2 completely breaks AES-GCM confidentiality and integrity guarantees for every TLS 1.2 and DTLS 1.2 connection using that cipher suite. Because the 8-byte explicit nonce is set once at key establishment and never incremented, every record in a session is encrypted under an identical (key, nonce) pair - the classical 'forbidden attack' condition where XORing two ciphertexts yields the XOR of the plaintexts, and the GHASH authentication key can be algebraically recovered to enable tag forgery. No active exploitation is confirmed in CISA KEV, and no public proof-of-concept has been identified at time of analysis; however, the attack is well-understood cryptography with no special tooling required beyond captured traffic.
Nonce reuse in wolfEngine's AES-CCM implementation for TLS 1.2 and DTLS 1.2 allows a network-positioned adversary to recover plaintext across records and forge authentication tags within a session. The root defect is that wolfEngine reads the explicit CCM nonce from the uninitialized record input buffer rather than deriving it from the TLS sequence number in the Additional Authenticated Data, producing a constant nonce for every record under the same key. Exposure is sharply constrained: AES-CCM cipher suites must be explicitly selected (non-default), only wolfEngine is affected (wolfProvider is not), and TLS 1.3 is entirely outside scope. No public exploit or CISA KEV listing exists at time of analysis; the vendor-released fix is wolfEngine 1.4.1.
Stack buffer overflow in wolfSSL 5.8.4's ECH (Encrypted Client Hello) implementation allows remote attackers to crash TLS clients or achieve code execution by sending a maliciously crafted ECH configuration. The vulnerability affects clients that have explicitly enabled ECH support, which is disabled by default. An attacker controlling a TLS server can exploit this remotely without authentication or user interaction.
CVE-2026-3503 is a security vulnerability (CVSS 4.3) that allows a physical attacker. Remediation should follow standard vulnerability management procedures.