CVE-2026-81020
Received Received - Intake

wolfEngine AES-GCM Nonce Reuse Vulnerability

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: wolfSSL Inc.

Description
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-29
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-81020
EUVD
EUVD-2026-67737

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wolfssl wolfengine to 1.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-323 Nonces should be used for the present occasion and only once.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

wolfEngine before version 1.4.1 has a flaw where it generates a single 8-byte nonce for AES-GCM encryption when a TLS write key is set and never changes it for subsequent records. This means every TLS 1.2 and DTLS 1.2 AES-GCM record in a connection uses the same key and nonce combination.

Detection Guidance

This vulnerability can be detected by checking the wolfEngine version. If your system uses wolfEngine before 1.4.1, it is vulnerable. Run wolfssl --version or check the installed package version to confirm.

Impact Analysis

This vulnerability allows attackers to recover plaintext by XORing ciphertexts if one record is known. It also enables forging authentication tags, compromising data integrity and confidentiality in affected connections.

Mitigation Strategies

Upgrade wolfEngine to version 1.4.1 or later to fix the nonce reuse issue. If using TLS 1.2 or DTLS 1.2 with AES-GCM, ensure the updated version is deployed across all affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81020. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart