CVE-2026-81019: CWE-323 Reusing a Nonce, Key Pair in Encryption in wolfSSL Inc. wolfProvider

wolfProvider before version 1.2.2 improperly handles the AES-GCM nonce by generating it once when the TLS write key is set and failing to increment it for each record. This results in reuse of the same key and nonce pair for every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection. Reusing a GCM key and nonce pair leaks the keystream and the GHASH authentication key, enabling attackers to recover plaintext from ciphertexts and forge authentication tags. Other cipher modes such as AES-CCM, TLS 1.3, and non-TLS usages are unaffected.

The vulnerability allows disclosure of the keystream and GHASH authentication key due to nonce reuse in AES-GCM encryption for TLS 1.2 and DTLS 1.2 records. This compromises confidentiality by enabling plaintext recovery from ciphertexts and integrity by allowing authentication tag forgery. There is no impact on availability. AES-CCM, TLS 1.3, and non-TLS cipher uses remain secure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to wolfProvider version 1.2.2 or later once available. Until then, avoid using affected versions (<=1.2.1) for TLS 1.2 or DTLS 1.2 AES-GCM encryption. No mitigation details or official fixes are currently published.