CVE-2026-10097: wolfSSL ML-KEM-1024 Incomplete Ciphertext Validation – Private Key Recovery

Technical summary

The vulnerability exists in wolfSSL's AVX2-optimized ML-KEM implementation, specifically in the mlkem_cmp_avx2 function used during ML-KEM-1024 decapsulation. The Fujisaki-Okamoto construction, which ML-KEM uses, depends on implicit rejection: a decapsulation operation must deterministically reject (and output a derived pseudorandom shared secret) if the ciphertext does not decrypt correctly to the original plaintext under re-encryption. wolfSSL's AVX2 code path skips comparison of bytes 1536–1567 during this check, meaning ciphertexts that differ only in those final 32 bytes bypass rejection and are treated as valid. This breaks IND-CCA2 indistinguishability under chosen-ciphertext attack. An attacker observing whether decapsulation returns the genuine shared secret or the implicit-rejection secret can use the oracle behavior to mount a plaintext-checking attack, ultimately recovering the private key via polynomial-time queries.

Business impact

Organizations deploying wolfSSL for post-quantum cryptography face loss of confidentiality of encrypted communications protected by ML-KEM-1024 keys. An attacker able to submit chosen ciphertexts to a decapsulation service and observe the resulting shared secret (or infer it indirectly through application behavior) can recover static private keys. This is particularly critical in scenarios where ML-KEM keys are intended to have long-term reuse—such as hybrid encryption schemes, key encapsulation in enterprise protocols, or TLS 1.3 with post-quantum key shares. Compromise of the private key enables retroactive decryption of all past communications encrypted to that key. For vendors and service providers using wolfSSL, this necessitates key rotation, re-evaluation of past encrypted data, and potentially breach notifications depending on scope of exposure.

Affected systems

The vulnerability affects wolfSSL's wolfssl library (all versions implementing the vulnerable AVX2-optimized ML-KEM code path for ML-KEM-1024). The flaw is specific to systems where AVX2 optimization is enabled and ML-KEM-1024 decapsulation is performed. Systems running on older CPUs without AVX2 support, or using the scalar (non-optimized) implementation path, are not affected. Determine affected systems by checking: (1) wolfSSL version in use, (2) whether AVX2 optimizations are compiled and enabled, and (3) whether ML-KEM-1024 is active in your cryptographic operations. Verify vendor guidance for the exact patched version number and conditional compilation flags.

Exploitability

Exploitability requires three conditions: (1) the attacker has network or local access to submit chosen ciphertexts to a decapsulation operation, (2) the attacker can observe or infer whether decapsulation produced the genuine shared secret or the implicit-rejection secret (via timing side-channels, error messages, or application behavior differences), and (3) the same private key is reused across multiple decapsulation queries. The attack is deterministic and does not depend on fine-grained timing measurements; coarse-grained side-channels (e.g., whether decryption succeeds or fails, or differences in application response time) are sufficient. The proof of concept required only ~350 chosen ciphertexts, making the barrier to exploitation low once the oracle is available. CVSS 7.5 (High) reflects high confidentiality impact with low attack complexity and no authentication requirement.

Remediation

Apply the patch from wolfSSL that corrects the mlkem_cmp_avx2 function to compare all 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check. Verify the corrected implementation is enabled (AVX2 code path is used) on deployment targets. After patching, conduct key rotation for any ML-KEM-1024 private keys that may have been exposed or used with ciphertexts an attacker could have crafted. If the scope of potential attacker access is known, limit key rotation scope accordingly. For systems that cannot immediately patch, consider disabling AVX2 optimization as a temporary workaround to force use of the scalar code path, though this carries a performance penalty.

Patch guidance

Contact wolfSSL or check the vendor security advisory for the specific patched version that resolves mlkem_cmp_avx2. The patch must verify that all 1568 bytes of the ciphertext are compared during decapsulation validation. Apply and test in a non-production environment first. Confirm that the patched library uses the corrected code path on your target hardware (AVX2-capable systems). After deployment, validate that no behavior change occurs in legitimate decapsulation operations. For systems where AVX2 is disabled or unavailable, confirm the scalar implementation path is unaffected by running unit tests from the wolfSSL test suite.

Detection guidance

Monitor for anomalous ciphertext submissions to services using wolfSSL ML-KEM-1024 decapsulation. If audit logs or application instrumentation is available, look for patterns of repeated failed decapsulation attempts (which might indicate oracle queries). Network-level detection is difficult without decryption context, but unusual volumes of ciphertext submissions from a single source to a decapsulation endpoint warrant investigation. If using application-level logging, instrument decapsulation code to log when the implicit-rejection secret is returned (versus the genuine secret) and correlate with source IP/identity. Intrusion detection rules should flag rapid-fire decapsulation requests from the same endpoint.

Why prioritize this

This vulnerability merits immediate prioritization because it directly breaks post-quantum cryptographic security guarantees (IND-CCA2) and requires only modest numbers of oracle queries to recover static private keys. While exploitation requires oracle access (limiting opportunistic attacks), any system exposing a decapsulation oracle is at risk. Post-quantum cryptography is increasingly deployed for long-term data protection; compromise of ML-KEM-1024 keys can have long-lasting impact. Organizations with customer-facing or sensitive encrypted systems using wolfSSL should patch urgently.

Risk score, explained

CVSS 7.5 (High) reflects: (1) High confidentiality impact—the private key and all encrypted communications are compromised; (2) Low attack complexity—the exploit is a deterministic logic error requiring no measurement or side-channel expertise; (3) Network vector—the attacker can submit ciphertexts remotely if the decapsulation oracle is accessible; (4) No authentication or user interaction required. Integrity and availability are not impacted directly. The score would be higher if the vulnerability also enabled ciphertext forgery or denial of service, but the flaw is specific to confidentiality loss through private key recovery.

Frequently asked questions