CVE-2026-10097

Name of the Vulnerable Software and Affected Versions wolfSSL (affected versions not specified)

Description The AVX2-optimized ML-KEM implementation contains a logic error in the mlkem cmp avx2 function during the Fujisaki-Okamoto transform. In ML-KEM-1024 decapsulation, the constant-time ciphertext comparison only checks 1536 of the 1568 ciphertext bytes, failing to compare the final 32-byte block. This allows ciphertexts manipulated only in those final bytes to bypass implicit rejection and be accepted as valid, breaking IND-CCA2 security (a security property ensuring that an attacker cannot distinguish between different decryptions of the same ciphertext). An attacker can use this as a plaintext-checking oracle to recover the private key by submitting chosen ciphertexts to a decapsulation oracle using a static ML-KEM-1024 key and observing the output. A proof of concept demonstrated private key recovery with approximately 98% success using roughly 350 chosen ciphertexts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.