CVE-2026-13735

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-13735

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13735.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-13735

Aliases

GHSA-xxrw-r78f-f6mx

Published

2026-08-28T20:38:50.695Z

Modified

2026-08-30T08:17:12.977742Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

WireGuard keepalive transport-data messages accepted without Poly1305 authentication

Details

Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wgcrypto.c mishandled keepalive packets. In wgprocessdatamessage(), any type-4 transport-data message whose payload was exactly 16 bytes (an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive) was accepted and returned immediately, before wgdecryptpacket() was ever called. The Poly1305 authentication tag was therefore never verified; the only preceding gates were a cleartext receiver-index lookup (getpeerkeypairforindex() on the attacker-supplied data_hdr->receiver) and a non-cryptographic keypair validity/expiry check.

The path is reachable entirely from the network: inbound UDP on the WireGuard port is dispatched by wginput() to handletransportdata() and then wgprocessdatamessage(). The 32-bit receiver index is transmitted in cleartext in WireGuard handshake and data messages, so an on-path observer learns it directly and an off-path attacker can brute-force it against the UDP port. Given an active receiving-valid session for that index, an attacker could send a 16-byte garbage payload and have it accepted without possessing the session key.

On acceptance the unauthenticated message caused the management layer to observe a spoofed NETEVENTVPNCONNECTED signal (setting peer->firstvalid and notifying any net_mgmt listener) and incremented the keepalive-RX statistic. The impact is limited to integrity of this status signal: no plaintext is decrypted or injected, no key is disclosed, and the early-return path did not update the peer endpoint or liveness timers, so there is no traffic-injection, session-takeover, or availability consequence.

The fix removes the pre-decrypt early return so a 16-byte payload flows through wgdecryptpacket(), which verifies the Poly1305 tag over the empty plaintext, followed by the existing anti-replay check; only an authenticated, non-replayed message is then recognised as a keepalive. Forged keepalives now fail the tag check and are counted as decrypt failures.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13735.json",
    "cwe_ids": [
        "CWE-290"
    ],
    "cna_assigner": "zephyr"
}

References

Affected packages

Git / github.com/zephyrproject-rtos/zephyr

Affected ranges

Type

GIT

Repo

https://github.com/zephyrproject-rtos/zephyr

Events

Introduced

684c9e8f32e4373a21098559f748f06915f950c9

Fixed

87c520a55f0f0e7cd4adf8780166e45eaad6d81c

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "4.4.0"
        },
        {
            "fixed": "4.4.2"
        }
    ]
}

Affected versions

v4.*

v4.4.0

Database specific

vanir_signatures

[
    {
        "id": "CVE-2026-13735-347c0501",
        "target": {
            "file": "subsys/net/lib/wireguard/wg_crypto.c"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "18635276415716625867733275086465581431",
                "302568142741183751589394891538570763713",
                "213543599759502005230833093905232517478",
                "88070670232955323555308087999190132173",
                "40984148538149733877764175429930878901",
                "302450822851061763873106091997119348403",
                "173994340155452646250710106747307416261",
                "19535356268115805935967410584552780717",
                "49956291015723853406243872476547833365",
                "171420908809214125598081123281473776732",
                "222144012558225053097924550071115888269",
                "16969940149563401650044940687924174184",
                "964976394941585290680283373464712585",
                "47880234042428587152148963439826927885",
                "209096055345821703734256939857123044745",
                "268900142374199602929954184951870847945",
                "210339593483420656622908764248730391181"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/87c520a55f0f0e7cd4adf8780166e45eaad6d81c",
        "signature_type": "Line"
    },
    {
        "id": "CVE-2026-13735-ce88b9d2",
        "target": {
            "function": "wg_process_data_message",
            "file": "subsys/net/lib/wireguard/wg_crypto.c"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "62271222734382762935760878513104810537",
            "length": 4227.0
        },
        "signature_version": "v1",
        "source": "https://github.com/zephyrproject-rtos/zephyr/commit/87c520a55f0f0e7cd4adf8780166e45eaad6d81c",
        "signature_type": "Function"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13735.json"

vanir_signatures_modified

"2026-08-30T08:17:12Z"