CVE-2026-5446: wolfSSL ARIA-GCM TLS 1.2/DTLS 1.2 GCM nonce reuse
In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wcAriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is zero-initialized at session setup and never incremented in non-FIPS builds. This vulnerability affects wolfSSL builds configured with --enable-aria and the proprietary MagicCrypto SDK (a non-default, opt-in configuration required for Korean regulatory deployments). AES-GCM is not affected because wcAesGcmEncryptex maintains an internal invocation counter independently of the call-site guard.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5446?
CVE-2026-5446 is considered to have a high severity due to the potential for nonce reuse in encryption, which could lead to data compromise.
How do I fix CVE-2026-5446?
To fix CVE-2026-5446, update wolfSSL to a version that is higher than 5.9.1, ensuring that nonce generation is handled correctly.
What specific software is affected by CVE-2026-5446?
CVE-2026-5446 affects wolfSSL built with the --enable-aria option and the proprietary MagicCrypto SDK.
What are the implications of CVE-2026-5446?
The implications of CVE-2026-5446 include potential exposure of encrypted communications and data integrity risks due to nonce reuse.
Can CVE-2026-5446 affect both TLS 1.2 and DTLS 1.2?
Yes, CVE-2026-5446 affects both TLS 1.2 and DTLS 1.2 when using ARIA-GCM cipher suites.