CVE-2026-55967: AES-GCM Counter Wraparound in wolfSSL Streaming APIs

Technical summary

CVE-2026-55967 is an improper input validation flaw (CWE-323) in wolfSSL's AES-GCM authenticated encryption with associated data (AEAD) implementation. The streaming API does not enforce the cryptographic limit of 2^39 - 256 bits (~64 GiB) of plaintext per key-nonce pair. When a single message exceeds this threshold, the internal counter overflows and restarts, causing keystream repetition. An attacker observing multiple ciphertexts encrypted under the same key and nonce with large messages can XOR them to recover plaintext. This breaks the semantic security guarantee of AES-GCM and violates NIST SP 800-38D specifications.

Business impact

Organizations relying on wolfSSL for TLS, embedded systems, IoT devices, or custom applications handling large encrypted streams face exposure of sensitive data transmitted or stored via AES-GCM. Financial impact includes potential data breach notification costs, regulatory fines under GDPR/HIPAA, loss of customer trust, and remediation overhead. The vulnerability is particularly severe for long-lived connections, backup systems, or any workload processing multi-gigabyte files under a single encryption context.

Affected systems

wolfSSL versions prior to the patched release are affected. Any application statically linked or dynamically loading vulnerable wolfSSL libraries and using the streaming AES-GCM encryption APIs with message sizes exceeding 64 GiB is at risk. This includes embedded TLS implementations, VPN clients, secure communications stacks, and custom cryptographic applications. Verify against wolfSSL's security advisory for exact patched versions and supported branches.

Exploitability

Exploitation requires network-level visibility of encrypted traffic or access to encrypted data at rest. An attacker must capture multiple ciphertexts produced with the same key-nonce pair and messages exceeding 64 GiB to perform cryptanalysis. While the technical bar is high, the absence of authentication or privilege requirements and the complete compromise of confidentiality make this a practical threat in scenarios involving large file encryption, streaming protocols, or persistent connections. No exploit code is publicly known at this time.

Remediation

Update wolfSSL to the patched version released to address this flaw. Verify the specific version number and patch status from wolfSSL's official security advisory. As an interim measure, limit single-message sizes to under 64 GiB, rotate keys before approaching this threshold, or migrate away from streaming APIs if alternative implementations enforce size limits. For defense-in-depth, apply network segmentation to reduce unauthorized observation of encrypted traffic.

Patch guidance

wolfSSL has released a patch to validate message size limits in the streaming AES-GCM implementation. Consult the official wolfSSL security advisory to identify the minimum patched version for your branch (stable, LTS, or development). Test the patch in a non-production environment to ensure compatibility with your TLS configuration and any custom cryptographic operations. Priority: immediate for systems processing messages approaching or exceeding 64 GiB.

Detection guidance

Monitor application logs for warnings or errors related to message size validation in AES-GCM operations. Use packet analysis to identify large encrypted streams under a single TLS session; legitimate use cases are rare. Query wolfSSL version strings in running processes and compare against patch advisories. Review application code for direct use of wolfSSL's streaming encryption APIs outside of standard TLS handshakes. Implement cryptographic telemetry to flag unusual message sizes or extended key-nonce reuse patterns.

Why prioritize this

The HIGH CVSS score (7.5) reflects complete loss of confidentiality with no authentication barriers. Although the 64 GiB threshold limits real-world exploitation, industries handling large encrypted volumes—backup providers, cloud storage, scientific computing, video streaming—must prioritize patching. The flaw is fundamental to the cryptographic implementation, not a configuration issue, making it impossible to mitigate fully without updating the library.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) is justified by: AV:N (network-accessible vulnerability), AC:L (no special conditions required), PR:N (no privilege needed), UI:N (no user interaction), S:U (impact isolated to confidentiality within the vulnerable system), C:H (high confidentiality impact—plaintext recovery). The score does not account for the high technical bar of needing messages >64 GiB, which is reflected in the reduced CVSS but does not lower the severity of the underlying cryptographic failure.

Frequently asked questions