{"id":"CVE-2026-13735","summary":"WireGuard keepalive transport-data messages accepted without Poly1305 authentication","details":"Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_data_message(), any type-4 transport-data message whose payload was exactly 16 bytes (an empty plaintext plus a bare Poly1305 tag, i.e. a keepalive) was accepted and returned immediately, before wg_decrypt_packet() was ever called. The Poly1305 authentication tag was therefore never verified; the only preceding gates were a cleartext receiver-index lookup (get_peer_keypair_for_index() on the attacker-supplied data_hdr-\u003ereceiver) and a non-cryptographic keypair validity/expiry check.\n\nThe path is reachable entirely from the network: inbound UDP on the WireGuard port is dispatched by wg_input() to handle_transport_data() and then wg_process_data_message(). The 32-bit receiver index is transmitted in cleartext in WireGuard handshake and data messages, so an on-path observer learns it directly and an off-path attacker can brute-force it against the UDP port. Given an active receiving-valid session for that index, an attacker could send a 16-byte garbage payload and have it accepted without possessing the session key.\n\nOn acceptance the unauthenticated message caused the management layer to observe a spoofed NET_EVENT_VPN_CONNECTED signal (setting peer-\u003efirst_valid and notifying any net_mgmt listener) and incremented the keepalive-RX statistic. The impact is limited to integrity of this status signal: no plaintext is decrypted or injected, no key is disclosed, and the early-return path did not update the peer endpoint or liveness timers, so there is no traffic-injection, session-takeover, or availability consequence.\n\nThe fix removes the pre-decrypt early return so a 16-byte payload flows through wg_decrypt_packet(), which verifies the Poly1305 tag over the empty plaintext, followed by the existing anti-replay check; only an authenticated, non-replayed message is then recognised as a keepalive. Forged keepalives now fail the tag check and are counted as decrypt failures.","aliases":["GHSA-xxrw-r78f-f6mx"],"modified":"2026-08-30T08:17:12.977742Z","published":"2026-08-28T20:38:50.695Z","database_specific":{"cwe_ids":["CWE-290"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13735.json","cna_assigner":"zephyr"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13735.json"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xxrw-r78f-f6mx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13735"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/87c520a55f0f0e7cd4adf8780166e45eaad6d81c"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"684c9e8f32e4373a21098559f748f06915f950c9"},{"fixed":"87c520a55f0f0e7cd4adf8780166e45eaad6d81c"}],"database_specific":{"extracted_events":[{"introduced":"4.4.0"},{"fixed":"4.4.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v4.4.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13735.json","vanir_signatures_modified":"2026-08-30T08:17:12Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/87c520a55f0f0e7cd4adf8780166e45eaad6d81c","target":{"file":"subsys/net/lib/wireguard/wg_crypto.c"},"deprecated":false,"digest":{"line_hashes":["18635276415716625867733275086465581431","302568142741183751589394891538570763713","213543599759502005230833093905232517478","88070670232955323555308087999190132173","40984148538149733877764175429930878901","302450822851061763873106091997119348403","173994340155452646250710106747307416261","19535356268115805935967410584552780717","49956291015723853406243872476547833365","171420908809214125598081123281473776732","222144012558225053097924550071115888269","16969940149563401650044940687924174184","964976394941585290680283373464712585","47880234042428587152148963439826927885","209096055345821703734256939857123044745","268900142374199602929954184951870847945","210339593483420656622908764248730391181"],"threshold":0.9},"id":"CVE-2026-13735-347c0501"},{"deprecated":false,"digest":{"length":4227,"function_hash":"62271222734382762935760878513104810537"},"id":"CVE-2026-13735-ce88b9d2","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/87c520a55f0f0e7cd4adf8780166e45eaad6d81c","target":{"function":"wg_process_data_message","file":"subsys/net/lib/wireguard/wg_crypto.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}