CVE-2026-81020
wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
| CWE | CWE-323 |
| Vendor | wolfssl inc. |
| Product | wolfengine |
| Published | Aug 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for wolfssl inc. wolfengine
Be the first to know when new high vulnerabilities affecting wolfssl inc. wolfengine are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
wolfSSL Inc. / wolfEngine
0 ≤ 1.4.0
References
Credits
wolfSSL security team