CVE-2026-55967

Summary

AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64 GiB) were not properly rejected by the streaming APIs, allowing counter wrap, keystream reuse, and consequent plaintext recovery.

Affected Software

Weaknesses

• CWE-323: CWE-323 Reusing a Nonce, Key Pair in Encryption

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/wolfSSL/wolfssl/pull/10709
• https://www.wolfssl.com/docs/security-vulnerabilities/

• ←Previous
• Next→