Medium

ARIA-GCM nonce reuse in wolfSSL TLS 1.2/DTLS 1.2 record encryption

IdentifiersCVE-2026-5446CWE-323· Reusing a Nonce, Key Pair in…

CVE-2026-5446 is a cryptographic nonce-reuse flaw in wolfSSL affecting ARIA-GCM cipher suites in TLS 1.2 and DTLS 1.2. In affected configurations, the same 12-byte GCM nonce is reused for every application-data record. The issue arises because wc_AriaEncrypt is stateless and forwards the caller-supplied IV directly to the proprietary MagicCrypto SDK without maintaining an internal counter, while the explicit IV is zero-initialized at session setup and, in non-FIPS builds, is never incremented. As a result, multiple records can be encrypted under the same key/nonce pair, violating GCM security requirements. The issue is limited to wolfSSL builds configured with --enable-aria and using the proprietary MagicCrypto SDK, a non-default opt-in configuration used for some Korean regulatory deployments. AES-GCM is not affected because wc_AesGcmEncrypt_ex maintains its own invocation counter independently.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Reuse of a GCM nonce with the same session key breaks the security assumptions of AEAD record protection. An attacker able to observe multiple ARIA-GCM protected TLS 1.2 or DTLS 1.2 application-data records encrypted under the reused nonce can derive relationships between plaintexts and undermine confidentiality; depending on traffic knowledge and protocol context, this can enable plaintext recovery or message manipulation opportunities associated with GCM nonce reuse. The flaw affects record-layer protection rather than certificate validation or key exchange, and exposure is constrained to the specific ARIA+MagicCrypto configuration.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, disable ARIA cipher suite support and rebuild without --enable-aria, or avoid deployments that use the proprietary MagicCrypto SDK. Prefer unaffected cipher suites such as AES-GCM. Restrict use of vulnerable builds to environments where ARIA is not negotiated, and verify server/client cipher configuration to prevent selection of ARIA-GCM suites until patched.

Remediation

Patch, then assume compromise.

Upgrade to wolfSSL 5.9.1 or later, which fixes CVE-2026-5446. If ARIA support is required, ensure the deployed build includes the vendor fix for nonce handling in TLS 1.2/DTLS 1.2 record encryption. Validate that affected binaries were built with the corrected wolfSSL release and that any downstream integrations using MagicCrypto have been rebuilt and redeployed.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

WolfsslWolfsslapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

anthropicNews

May 22, 2026

Anthropic's coordinated vulnerability disclosure dashboard

A high-severity cryptographic flaw in wolfSSL involving ARIA-GCM nonce reuse in TLS 1.2 record encryption.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2