CVE-2026-81020

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.wolfssl.com/docs/security-vulnerabilities/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wolfssl:wolfengine:*:*:*:*:*:*:*:*

History

29 Sep 2026, 19:10

Type	Values Removed	Values Added
First Time		Wolfssl Wolfssl wolfengine
CPE		cpe:2.3:a:wolfssl:wolfengine::::::::
References	~~() https://www.wolfssl.com/docs/security-vulnerabilities/ -~~	() https://www.wolfssl.com/docs/security-vulnerabilities/ - Vendor Advisory

Information

Published : 2026-08-28 16:18

Updated : 2026-09-29 19:10

NVD link : CVE-2026-81020

Mitre link : CVE-2026-81020

CVE.ORG link : CVE-2026-81020

JSON object : View

Products Affected

wolfssl

wolfengine

CWE

CWE-323

Reusing a Nonce, Key Pair in Encryption

{"id": "CVE-2026-81020", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-81020", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-28T18:18:47.224871Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "facts@wolfssl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "facts@wolfssl.com", "affectedData": [{"repo": "https://github.com/wolfSSL/wolfengine", "vendor": "wolfSSL Inc.", "product": "wolfEngine", "versions": [{"status": "affected", "version": "0", "versionType": "git", "lessThanOrEqual": "1.4.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-28T16:18:28.890", "references": [{"url": "https://www.wolfssl.com/docs/security-vulnerabilities/", "tags": ["Vendor Advisory"], "source": "facts@wolfssl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "facts@wolfssl.com", "description": [{"lang": "en", "value": "CWE-323"}]}], "descriptions": [{"lang": "en", "value": "wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected."}], "lastModified": "2026-09-29T19:10:21.303", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wolfssl:wolfengine:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBB86E18-F3C5-4C3A-A8D4-BBBE9581AB3A", "versionEndExcluding": "1.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "facts@wolfssl.com"}