CVE-2026-81020 json
wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
published 2026-08-28 2 mo ago modified 2026-09-29 40 d ago also EUVD-2026-67737
- cvss
- 7.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
Patch / fix
- wolfssl wolfengine 1.4.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected products
- wolfSSL Inc. wolfEngine
Classification
- Weakness
-
- CWE-323 Reusing a Nonce, Key Pair in Encryption
References
-
wolfssl.com
/docs/security-vulnerabilities/
vendor-advisory
Sources
- CVE List CVE-2026-81020
- NVD CVE-2026-81020
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.