CVE-2026-10097

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-10097
wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check in ML-KEM-1024 decapsulation. Ciphertexts that differ from the expected re-encryption solely in bytes 1536-1567 bypass implicit rejection and are accepted as valid, breaking IND-CCA2 security. An attacker able to submit chosen ciphertexts to a decapsulation oracle that uses a static ML-KEM-1024 key, and to observe whether the genuine shared secret or the implicit-rejection secret was produced, can use this as a plaintext-checking oracle to recover the private key. A proof of concept recovered a full ML-KEM-1024 private key with approximately 98% success using roughly 350 chosen ciphertexts. The flaw is a deterministic logic error and does not rely on timing measurements.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/wolfSSL/wolfssl/pull/10430 Issue Tracking Patch
https://www.wolfssl.com/docs/security-vulnerabilities/ Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*
History

26 Jun 2026, 17:16

Type Values Removed Values Added
CWE CWE-327 CWE-697
Summary (en) ML-KEM-1024 x64 AVX2 implicit rejection failure in the Fujisaki-Okamoto transform breaks IND-CCA2 security, allowing decapsulation to deviate from the implicit-rejection behavior required by the standard. The AVX2 constant-time ciphertext comparison used during decapsulation never compared the final 32-byte block of the 1568-byte ML-KEM-1024 ciphertext, so a ciphertext manipulated only in those final bytes would compare as equal and decapsulation returned the real shared secret instead of performing the required implicit rejection. (en) wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext bytes during the Fujisaki-Okamoto re-encryption check in ML-KEM-1024 decapsulation. Ciphertexts that differ from the expected re-encryption solely in bytes 1536-1567 bypass implicit rejection and are accepted as valid, breaking IND-CCA2 security. An attacker able to submit chosen ciphertexts to a decapsulation oracle that uses a static ML-KEM-1024 key, and to observe whether the genuine shared secret or the implicit-rejection secret was produced, can use this as a plaintext-checking oracle to recover the private key. A proof of concept recovered a full ML-KEM-1024 private key with approximately 98% success using roughly 350 chosen ciphertexts. The flaw is a deterministic logic error and does not rely on timing measurements.

26 Jun 2026, 16:53

Type Values Removed Values Added
First Time Wolfssl wolfssl
Wolfssl
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/wolfSSL/wolfssl/pull/10430 - () https://github.com/wolfSSL/wolfssl/pull/10430 - Issue Tracking, Patch
References () https://www.wolfssl.com/docs/security-vulnerabilities/ - () https://www.wolfssl.com/docs/security-vulnerabilities/ - Vendor Advisory
CPE cpe:2.3:a:wolfssl:wolfssl:*:*:*:*:*:*:*:*

25 Jun 2026, 20:22

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-25 20:17

Updated : 2026-06-26 17:16

NVD link : CVE-2026-10097

Mitre link : CVE-2026-10097

CVE.ORG link : CVE-2026-10097

JSON object : View

Products Affected

wolfssl

  • wolfssl
CWE
CWE-697

Incorrect Comparison