CVE-2026-81019

Executive Summary

CVE-2026-81019 is a critical cryptographic nonce-reuse vulnerability in wolfProvider versions prior to 1.2.2, the OpenSSL-compatibility provider layer for wolfSSL. The flaw causes the 8-byte explicit AES-GCM nonce to be generated once when the TLS write key is set and never incremented per record, resulting in every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection being encrypted under an identical (key, nonce) pair. This catastrophic nonce reuse permits a network-level attacker to recover plaintext from multiple records if one record's plaintext is known, and to forge GHASH authentication tags, potentially compromising confidentiality and integrity of all TLS 1.2/DTLS 1.2 AES-GCM sessions handled by affected systems. The flaw carries a CVSS score of 7.4 (High) and currently has no known patch, PoC, or exploitation in the wild, leaving affected enterprise deployments exposed.

Technical Analysis

Vulnerability Class: CWE-323 — Reusing a Nonce, Key Pair in Encryption.

The vulnerability resides in the nonce-generation logic of the wolfProvider module (versions < 1.2.2) when operating as an OpenSSL-compatible provider for AES-GCM in TLS 1.2 and DTLS 1.2. In the TLS 1.2/DTLS 1.2 record protocol, AES-GCM requires a unique 8-byte explicit nonce to be generated for every record, combined with a per-connection implicit salt (4 bytes from the key schedule) to form the full 12-byte IV. The specification requires that the explicit part be incremented monotonically per record to guarantee uniqueness across the connection's lifetime.

In affected wolfProvider versions, the explicit 8-byte nonce is initialized once — at the moment the TLS write key is established (key-set event) — and is never incremented. Consequently, every record sent during the remainder of the connection reuses the exact same (key, nonce) pair.

Cryptographic Impact of Nonce Reuse in GCM:

When two ciphertexts C₁ = AES-GCM(K, N, P₁) and C₂ = AES-GCM(K, N, P₂) share the same key K and nonce N:

• The keystream (the output of AES-CTR mode used internally by GCM) is identical for both records: C₁ ⊕ C₂ = P₁ ⊕ P₂. If an attacker knows one plaintext (e.g., via a known protocol header, TLS record structure, or chosen-ciphertext access), they can trivially recover the other plaintext.
• The GHASH authentication key, H = AES_K(0¹²⁸), is also compromised. For a given (K, N), GCM's authentication tags T₁ and T₂ are polynomial functions of H. With two known (plaintext, ciphertext, tag) pairs sharing the same (K, N), an attacker can solve for H algebraically. Once H is known, the attacker can forge valid authentication tags for arbitrary ciphertexts of their choosing, completely breaking the integrity guarantees of AES-GCM.

Attack Surface Elements:

• The attack is purely passive for plaintext recovery (requires eavesdropping on a single connection) and active for tag forgery (requires a man-in-the-middle position to inject forged records).
• The attacker needs to observe at least two records from the same connection, one of which has a known plaintext (e.g., a TLS Finished message, HTTP response headers, or any predictable application-layer data).
• The vulnerability affects all TLS 1.2 and DTLS 1.2 AES-GCM cipher suites handled by wolfProvider. Libraries or applications using wolfProvider 1.2.1 or earlier as their crypto provider for OpenSSL-compatible interfaces are impacted.
• AES-CCM cipher suites, TLS 1.3 (which uses a different nonce derivation per record), and non-TLS direct API use of AES-GCM through wolfSSL/wolfProvider are explicitly noted as NOT affected.

Technical Trigger Points:

• The bug manifests at the provider's key-set callback/context initialization, where the nonce state should be initialized, and the record-write path, where the nonce should be read-and-incremented. The NVD description indicates the increment step is missing entirely.
• No code-level function names, file paths, or API endpoints are provided in the official description. The flaw mechanism is fully described at the protocol/state-management level.

Exploitation Scenarios

Attack Chain Steps:

1) Reconnaissance / Target Identification:

• An attacker targeting an organization would first identify servers or services using wolfSSL with wolfProvider 1.2.1 or earlier. This can be done via:
  • TLS fingerprinting (JA3/JA4 hashes) to distinguish wolfSSL's ClientHello/ServerHello characteristics from OpenSSL's.
  • Banner grabbing on services exposing application-layer identifiers (e.g., embedded firmware, IoT devices using wolfSSL).
  • Passive network monitoring of TLS handshakes to detect DTLS 1.2 or TLS 1.2 AES-GCM cipher suite negotiation.
• The attacker requires a vantage point on the network path between client and server (e.g., same LAN, compromised network device, ISP-level intercept) to observe record traffic.

2) Triggering the Flaw:

• The attacker does not need to send any crafted input to trigger the bug — it manifests automatically on the server side whenever the server writes a TLS 1.2/DTLS 1.2 AES-GCM record. The flaw is state-confined: once the write key is set, all subsequent records use the identical nonce.
• The attacker simply needs the victim server to generate traffic (e.g., responding to client requests, streaming data). The first record and every subsequent record from the same connection share the nonce.

3) Payload / Execution Method (Vulnerability-Class Level):

• Confidentiality Breach (Passive): The attacker captures all records from the connection. For at least one record, they know or can guess the plaintext — typical candidates include:
  • The first application-data record following the handshake (e.g., HTTP/1.1 response headers like HTTP/1.1 200 OK contain high-entropy but partially predictable structure).
  • TLS record layer headers, which are authenticated but not encrypted in AES-GCM (the length and type fields are known).
  • Any record where prior knowledge of the protocol permits plaintext recovery.
  • With one known plaintext, the attacker computes P₂ = C₁ ⊕ C₂ ⊕ P₁, instantly decrypting all other records in that connection.
• Integrity Breach (Active): Using two known (P, C, T) triples, the attacker solves the GHASH polynomial for the authentication key H. The attacker can then:
  • Forge authentication tags for arbitrary ciphertexts.
  • Inject modified records into the stream without detection, altering application data or injecting malicious content (e.g., redirecting a session, injecting commands into a protocol stream).
  • Potentially forge TLS Finished messages to corrupt the handshake, though this is secondary to the data-plane forgery capability.

4) Post-Exploitation Impact:

• Full plaintext recovery of all TLS 1.2/DTLS 1.2 AES-GCM traffic for the affected connection (and any other concurrent connections, as each connection reuses the same static nonce for that connection's key).
• Authentication bypass at the record layer: forged records are accepted as authentic, enabling data injection into protocols like HTTPS, MQTT, or custom TCP-over-DTLS applications.
• Loss of confidentiality and integrity for affected sessions — session tokens, credentials, and sensitive payloads can be exfiltrated or modified.
• The attacker does not gain direct remote code execution from this vulnerability alone; it is strictly a cryptographic failure enabling data compromise.

PoC Status: No public PoC exists as of the report date. The attack chain above is inferred directly from the cryptographic vulnerability class (GCM nonce reuse), which is well-documented in academic literature and prior CVEs (e.g., CVE-2019-16864, A10 Networks' KRACK-style GCM nonce issues). Security teams should treat this as a high-risk logical flaw even absent published exploit code.

Impact Assessment

CVSS Breakdown (3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N ):

• Attack Vector (AV:N): Network — exploitable from any remote position with packet-capture capabilities.
• Attack Complexity (AC:H): High — requires a man-in-the-middle position or passive network tap, plus knowledge of at least one record's plaintext for full confidentiality impact.
• Privileges Required (PR:N): None — unauthenticated exploitation.
• User Interaction (UI:N): None — no victim interaction needed beyond normal traffic generation.
• Scope (S:U): Unchanged — the compromise is confined to the cryptographic bounds of the connection.
• Confidentiality Impact (C:H): High — complete plaintext recovery of affected connections.
• Integrity Impact (I:H): High — authentication tag forgery allows data modification.
• Availability Impact (A:N): None — the flaw does not enable denial-of-service directly.

Business Impact:

• Affected Systems: Any enterprise system embedding wolfSSL/wolfProvider as its cryptographic provider — including embedded IoT devices, network appliances (VPN gateways, routers), industrial control systems, and software-defined networking components. Applications using OpenSSL-compatible APIs linked against wolfProvider 1.2.1 or earlier are at risk.
• Blast Radius: The vulnerability undermines the foundational security of TLS 1.2/DTLS 1.2 AES-GCM sessions. If an attacker intercepts a connection (e.g., due to insecure network infrastructure, DNS poisoning, or a compromised upstream router), they can decrypt all application-layer data — including credentials, personal data, and commands — and inject forged data. The impact is amplified in environments using long-lived connections (e.g., persistent MQTT sessions in IoT, database replication streams), where more records accumulate under one reused nonce.
• Regulatory Consequences: Data exposure due to a known cryptographic weakness may trigger breach-notification requirements under GDPR, HIPAA, or PCI DSS. Organizations using affected wolfProvider builds for compliance-sensitive data transfers face elevated risk.
• Patch Confidence (0/4): No vendor advisory, CVE patch, or upgrade path has been tracked by any source other than the NVD description itself, which implies a fix is present in wolfProvider 1.2.2 but no official announcement was captured. Until verifiable, treat the vulnerability as unpatched for 1.2.1 and earlier.

Detection Guidance

Note: Detection of this flaw is challenging because it is a state bug — no malicious packet content distinguishes exploitation from normal traffic. The following rules target anomaly indicators of nonce reuse (e.g., duplicate record nonces) and known cryptographic-attack patterns (e.g., repeated GHASH-related anomalies). These rules are heuristic and may generate false positives on benign encrypted traffic; tune thresholds for your environment.

Sigma Rule

title: Suspicious TLS 1.2/DTLS 1.2 Record Nonce Reuse Detection
id: 4f5c3a2b-8e7d-4a1f-9c3b-2a6d5e8f1b7c
status: experimental
description: Detects when a TLS/DTLS 1.2 record contains an AES-GCM explicit nonce that has been observed previously on the same connection, indicative of GCM nonce reuse (CVE-2026-81019).
logsource:
  category: network_traffic
  product: packet_analysis
  service: tls
detection:
  selection:
    event.action: tls.*
    tls.version: ["TLSv1.2", "DTLSv1.2"]
    tls.cipher_suite|startswith: "TLS_*_GCM_"
  condition: selection
  # The core logic is: for each connection (tls.session_id + tls.server_ip + tls.server_port),
  # check if tls.record_nonce (the 8-byte explicit nonce) appears more than once.
  # This requires custom detection logic in SIEM; Sigma is used to target the event stream.
  # A practical proxy: flag connections with >1 record having identical nonce values (see SPL below).
  timeframe: 5m
level: high
tags:
  - attack.t1190
  - cve.2026-81019

YARA Rule

rule CVE_2026_81019_GCM_Nonce_Reuse_Heuristic {
    meta:
        author = "Valter Security Team"
        description = "Heuristic detection of GCM nonce reuse patterns in TLS/DTLS packet captures. Detects repeated 8-byte nonce values within a packet stream."
        cve = "CVE-2026-81019"
        date = "2026-05-15"
    strings:
        // Look for pattern of two identical 8-byte sequences within a TLS application data record
        // This is a capture-file heuristic — for PCAP processing.
        $nonce_reuse = { 17 03 03 [4] ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? [0-4] 17 03 03 [4] ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? }
        // 17 03 03 = TLS 1.2 Application Data record header
        // [4] = 2-byte length + 2-byte first fragment bytes (implicit salt field)
        // ?? x8 = explicit nonce (first occurrence)
        // then the record body; second record with same nonce pattern
    condition:
        uint16(0) == 0x0a0d and $nonce_reuse
       // PCAP global header magic for little-endian (0x0a0d)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-81019 - Suspicious GCM Nonce Reuse in TLS/DTLS 1.2"; flow:established; content:"|17 03 03|"; depth:3; content:"|17 03 03|"; distance:0; within:16384; byte_test:2,>,100,4; metadata:soalid_family "tls"; reference:cve,2026-81019; classtype:attempted-admin; sid:202681019; rev:1;)

Explanation: This rule matches TLS 1.2 Application Data records (header 17 03 03) with a length field (bytes 4-5) greater than 100 bytes, appearing twice in close proximity (within 16KB, typical record size). The detection of duplicate records is a weak signal; a more precise rule would require Suricata's TLS parser to expose per-connection record nonces, which is not natively available. This rule flags packet sequences where two Application Data records exist back-to-back, indicating potential record padding or nonce-anomaly patterns. Tune or disable if false-positive rate is high.

Elastic Detection

// EQL query targeting Elastic Packetbeat or Winlogbeat with TLS metadata
sequence by tls.session_id, source.ip, destination.ip, source.port, destination.port
  [ network where event.action == "tls" and tls.version == "TLSv1.2" and
    tls.cipher_suite ~= ".*GCM.*" and tls.record_nonce != null ]
  [ network where event.action == "tls" and tls.version == "TLSv1.2" and
    tls.cipher_suite ~= ".*GCM.*" and tls.record_nonce != null ]
  | join by tls.record_nonce
  | stats count = count(tls.record_nonce) by tls.session_id
  | where count > 1

Explanation: This EQL sequence attempts to correlate two TLS records from the same connection (tls.session_id) sharing an identical tls.record_nonce value. If the packet capture feeds tls.record_nonce into Elastic's indexing (via Packetbeat's TLS dissector), this will flag genuine nonce reuse. Without that field populated, rely on the Sigma/Splunk alternatives.

Splunk SPL Query

index=packetbeat sourcetype=tls OR sourcetype=network_traffic
| where tls.version IN ("TLSv1.2", "DTLSv1.2") AND match(tls.cipher_suite, "^TLS_*_GCM_")
| stats values(_time) as first_seen, latest(_time) as last_seen,
        dc(tls.record_nonce) as unique_nonces,
        count as record_count
  by tls.session_id, source.ip, dest.ip
| where record_count > 100 AND unique_nonces < (record_count * 0.1)
| eval probability = round((record_count - unique_nonces) / record_count * 100, 2)
| where probability > 50
| table _time, tls.session_id, source.ip, dest.ip, record_count, unique_nonces, probability

Explanation: This query leverages the expectation that in a healthy TLS 1.2 connection with N records, there should be N unique explicit nonces. In a vulnerable wolfProvider connection, all records share one nonce, so unique_nonces ≈ 1 (combined with the implicit salt, the full nonce is constant). The threshold of unique_nonces < 10% of record_count with record_count > 100 reduces false positives from short connections.

Wazuh OSSEC Rule

<group name="cve-2026-81019,tls,">
    <rule id="100889" level="12">
        <decoded_as>json</decoded_as>
        <field name="event.action" type="string">tls</field>
        <field name="tls.version" type="string">TLSv1.2|DTLSv1.2</field>
        <field name="tls.cipher_suite" type="string">.*GCM.*</field>
        <description>CVE-2026-81019: Potential AES-GCM nonce reuse detected in TLS 1.2/DTLS 1.2 record stream. Multiple records sharing identical explicit nonce.</description>
        <group>cve, cryptography,</group>
        <mitre>
            <id>t1190</id>
        </mitre>
    </rule>
</group>

Operational Note: The Wazuh rule triggers on any TLS 1.2/DTLS 1.2 GCM traffic, generating a high-severity alert for correlation. SOC analysts should correlate with the Splunk/Sigma queries to confirm nonce duplication before escalating. This rule serves as a baseline signal requiring human triage.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no confirmed patch evidence). The NVD description states the flaw is fixed in wolfProvider 1.2.2, but no official vendor advisory has been tracked. Verify directly with wolfSSL before assuming a patch exists.

Immediate Mitigations (no patch available):

1. Disable TLS 1.2 AES-GCM cipher suites on systems using wolfProvider < 1.2.2. Force use of AES-CCM cipher suites (e.g., TLS_ECDHE_RSA_WITH_AES_256_CCM) or TLS 1.3 if supported, as these are confirmed unaffected.
2. Reconfigure DTLS 1.2 servers to prefer alternative cipher suites (ChaCha20-Poly1305 if available, or AES-CCM) to prevent GCM nonce reuse.
3. Limit connection lifetime — if AES-GCM TLS 1.2 cannot be avoided, configure aggressive session renegotiation/key rotation (e.g., renegotiate keys every N records or after T seconds). Minimizes the number of records encrypted under a single key-nonce pair, reducing the attack surface (attacker needs ≥2 records with known plaintext).
4. Network segmentation — restrict network paths so potential Man-in-the-Middle positions are reduced; enforce cryptographic traffic between trusted zones only.

Patch/Upgrade Steps:

1. Contact wolfSSL support or monitor their release feed for wolfProvider 1.2.2 or later.
2. When available, upgrade all systems using wolfProvider to ≥1.2.2. Verify the version string after deployment via wolfSSL_GetVersion or package manager checks.
3. Validate the library upgrade in a staging environment, ensuring OpenSSL-compatible API behavior is unchanged and no regressions occur in TLS handshake performance.
4. After upgrading, systematically re-run TLS 1.2 AES-GCM interop tests against OpenSSL clients to confirm normal nonce increment behavior (capture traffic and verify unique explicit nonces per record).

Long-Term Hardening:

1. Cryptographic audit: Review all TLS 1.2/DTLS 1.2 configurations enterprise-wide; prioritize migration to TLS 1.3, which is immune to this nonce-generation flaw class.
2. Vendor risk management: For organizations using wolfSSL in embedded/IoT products, require suppliers to disclose wolfProvider versions and verify compliance with the fixed 1.2.2 build.
3. Monitoring: Deploy the detection queries above (Splunk/Elastic) in SOC pipelines to catch nonce-reuse anomalies in real-time, not just for this CVE but as a general cryptographic hygiene signal.
4. Registry maintenance: Maintain an inventory of all deployed cryptographic providers and versions; automate checks for this CVE and similar issues via SBOM (Software Bill of Materials) tooling.
5. Incident response preparation: Pre-draft a response plan for confirmed plaintext-recovery events — assume any traffic observed during exposure windows may be compromised. Prepare key rotation procedures for any application-layer credentials transmitted.

References

1. NVD Entry for CVE-2026-81019 — https://nvd.nist.gov/vuln/detail/CVE-2026-81019 (official record, NVD description quoted above).

2. wolfSSL Official Site — https://www.wolfssl.com/ (vendor portal for wolfProvider release announcements; monitor for 1.2.2+ security advisory).

3. CWE-323: Reusing a Nonce, Key Pair in Encryption — https://cwe.mitre.org/data/definitions/323.html (weakness class documentation, pattern matches this CVE).

4. Prior Art: GCM Nonce Reuse in TLS (Academic Reference) — Joux, A. "Authentication Failures in NIST Version of GCM" (2006), and subsequent analyses of GCM nonce-reuse attacks, establishing the keystream-recovery and GHASH-forgery techniques referenced here. (Searchable via IACR ePrint archive.)

5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (checked: CVE-2026-81019 is NOT listed; no evidence of exploitation in the wild as of the report date).

Threat Actor Campaign Assessment: No known threat actor campaigns have been publicly attributed to this vulnerability. The flaw's complexity (requires MITM position and plaintext knowledge) and lack of patch availability reduce immediate weaponization likelihood, but the cryptographic class is well-understood, so weaponization should be expected once the fix is widely shipped (attacker interest shifts to unpatched legacy systems). Monitor for post-patch news regarding in-the-wild exploitation.