CVE-2026-5446

NameCVE-2026-5446
DescriptionIn wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wc_AriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is zero-initialized at session setup and never incremented in non-FIPS builds. This vulnerability affects wolfSSL builds configured with --enable-aria and the proprietary MagicCrypto SDK (a non-default, opt-in configuration required for Korean regulatory deployments). AES-GCM is not affected because wc_AesGcmEncrypt_ex maintains an internal invocation counter independently of the call-site guard.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
wolfssl (PTS)bullseye4.6.0+p1-0+deb11u2vulnerable
bookworm5.5.4-2+deb12u2vulnerable
trixie5.7.2-0.1+deb13u1vulnerable
forky, sid5.9.0-0.2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
wolfsslsource(unstable)(unfixed)

Notes

https://github.com/wolfSSL/wolfssl/pull/10111
Fixed by (merge): https://github.com/wolfSSL/wolfssl/commit/2cd4f1c69d34e9179a2db770c93cb3c3585bdc28 (v5.9.1-stable)

Search for package or bug name: Reporting problems