CVE-2026-50577

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves requestcounter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counte...

CVE-2026-50577 ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves requestcounter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counte...

CVE-2026-50577

In ePA 3.x Integration (fbeta-GmbH), request_counter is left unchanged in app/vau/VAUProtokoll.py, causing the server to reuse AES-GCM nonce/key pairs across responses. This enables a network attacker to recover plaintext XORs, exploit the Joux forbidden attack to recover the GHASH key, forge mes...

PT-2026-31736

In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS 1.2 reuse an identical 12-byte GCM nonce for every application-data record. Because wc AriaEncrypt is stateless and passes the caller-supplied IV verbatim to the MagicCrypto SDK with no internal counter, and because the explicit IV is...

ANT-2026-SB4PHA43 · wolfSSL · Cryptographic Nonce Reuse

crypto-failure high CVE-2026-5446 Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Calif. ANT-2026-SB4PHA43: ARIA-GCM Nonce Reuse in TLS 1.2 Record...

📄 OpenSSL 3.x ASN.1 AES‑GCM Nonce Stack Corruption

This Metasploit auxiliary module generates a specially crafted CMS file encoded in DER format to test a stack-based buffer overflow vulnerability in OpenSSL's ASN.1 parser related to improper handling of oversized AES-GCM nonce IV values within AES-GCM-Parameters as defined in RFC 5084. The...

EUVD-2016-1398

Malware in sbrugna...

EUVD-2017-15007

Malware in sbrugna...

CVE-2024-23688

Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed...

Code injection

Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed...

DEBIAN-CVE-2021-32791

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In modauthopenidc before version 2.4.9, the AES GCM encryption in modauthopenidc uses a static IV and...

CVE-2016-10212

Radware devices use the same value for the first two GCM nonces, which allows remote attackers to obtain the authentication key and spoof data via a "forbidden attack," a similar issue to CVE-2016-0270. NOTE: this issue may be due to the use of a third-party Cavium product...

CVE-2017-5933

Citrix NetScaler ADC and NetScaler Gateway 10.5 before Build 65.11, 11.0 before Build 69.12/69.123, and 11.1 before Build 51.21 randomly generates GCM nonces, which makes it marginally easier for remote attackers to obtain the GCM authentication key and spoof data by leveraging a reused nonce in ...

CVE-2016-10213

A10 AX1030 and possibly other devices with software before 2.7.2-P8 uses random GCM nonce generations, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging a reused nonce in a session and a "forbidden attack," a similar issue to CVE-2016-0270...

CVE-2016-10213

CVE-2016-10213 affects A10 AX1030 and possibly other devices running software before 2.7.2-P8. The vulnerability arises from random GCM nonce generation, enabling remote attackers to obtain the authentication key and spoof data by reusing a nonce in a session, described as a “forbidden attack” si...

CVE-2016-10212

CVE-2016-10212 describes a GCM nonce reuse issue in Radware devices (note: may involve a third-party Cavium product) that allows remote attackers to obtain the authentication key and spoof data via a “forbidden attack.” Root cause: reuse of the initial nonces in GCM. Affected: Radware devices. Ex...

CVE-2017-5933 - Vulnerability in Citrix NetScaler Application Delivery Controller and NetScaler Gateway GCM nonce generation

Description of Problem A flaw in NetScaler ADC and Gateway causes GCM nonces to be randomly generated, making it marginally easier for remote attackers to obtain the GCM authentication key and spoof data within a session. The following vulnerability has been addressed: CVE-2017-5933: Vulnerabilit...

SOL05405841 - GCM nonce vulnerability CVE-2016-0270

Vulnerability Recommended Actions None Supplemental Information SOL9970: Subscribing to email notifications regarding F5 products SOL9957: Creating a custom RSS feed to view new and updated documents SOL4602: Overview of the F5 security vulnerability response policy SOL4918: Overview of the F5...