CVE-2026-81019: wolfProvider reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wolfProviderto a version that resolves this vulnerability.Fixed in 1.2.2 - Configuration
As an interim mitigation, avoid TLS 1.2 / DTLS 1.2 AES-GCM and use AES-CCM or TLS 1.3 instead.
TLS/DTLS (AES-GCM cipher usage) Use of TLS 1.2 / DTLS 1.2 AES-GCM = Use AES-CCM or TLS 1.3 instead of TLS 1.2 / DTLS 1.2 AES-GCM
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using wolfProvider versions before 1.2.2 are affected when they use AES-GCM with TLS 1.2 or DTLS 1.2. AES-CCM, TLS 1.3, and non-TLS uses of the cipher are not affected.
What does an attacker need to exploit this issue?
The issue is network-reachable and requires no privileges or user interaction, but exploitation has high attack complexity. The disclosed impact describes recovery of other plaintexts when a record plaintext is known, as well as authentication-tag forgery after GHASH key leakage.
How can I determine whether a connection is exposed?
Check whether wolfProvider is earlier than version 1.2.2 and whether the affected connection negotiates TLS 1.2 or DTLS 1.2 with an AES-GCM cipher. Connections using TLS 1.3 or AES-CCM are not affected.
What can be used as a temporary mitigation if upgrading is not immediately possible?
Avoid AES-GCM for TLS 1.2 and DTLS 1.2 connections. The provided information identifies TLS 1.3 and AES-CCM as unaffected alternatives.