wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-81020
- 2026-10-03 Alias added: GHSA-8x67-443h-6cwx
References
Advisory 1
More wolfSSL Wolfengine vulnerabilities
- TI-2026-56159 wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records CVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-81020 · CVE Program
- CVE-2026-81020 · NVD
- FIRST EPSS
- GHSA-8x67-443h-6cwx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences