---
id: CVE-2026-81019
title: >-
  wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once
  when the TLS write key is set and never increments it per record
summary: >-
  wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once
  when the TLS write key is set and never increments it per record. As a result
  every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted
  under an …
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-323
vendor: wolfssl
product: wolfprovider
affected:
  - wolfprovider < 1.2.2
patched:
  - wolfprovider 1.2.2
published: '2026-08-28'
updated: '2026-09-29'
sourceUpdated: '2026-09-29T19:11:58.053'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81019'
references:
  - url: 'https://www.wolfssl.com/docs/security-vulnerabilities/'
    label: facts@wolfssl.com
tags:
  - nvd
epss: 0.00383
epssPercentile: 0.2981
ingestedAt: '2026-09-29T19:44:04.118Z'
---

## Overview

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

## Affected

- `wolfprovider < 1.2.2`

## Remediation

Upgrade past the affected range:

- `wolfprovider 1.2.2`