CVE-2026-81020: wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wolfEngineto a version that resolves this vulnerability.Fixed in 1.4.1 - Compensating control
As an interim mitigation, use AES-CCM or TLS 1.3 instead of TLS 1.2 / DTLS 1.2 AES-GCM.
Event History
Frequently Asked Questions
Which deployments are affected?
wolfEngine versions before 1.4.1 are affected when they use AES-GCM for TLS 1.2 or DTLS 1.2 records. AES-CCM, TLS 1.3, and non-TLS cipher use are not affected.
What can an attacker gain from nonce reuse?
Every AES-GCM record in an affected connection uses the same key and nonce pair. A known record can recover the keystream for other records, and leakage of the GHASH authentication key can enable authentication-tag forgery.
What can be done if upgrading is not immediately possible?
Avoid AES-GCM with TLS 1.2 and DTLS 1.2 in affected wolfEngine deployments. Using TLS 1.3 or AES-CCM avoids the affected behavior.
How can I determine whether a connection is at risk?
Confirm whether the deployment uses wolfEngine before 1.4.1 and negotiates AES-GCM under TLS 1.2 or DTLS 1.2. If so, every AES-GCM record within an individual connection is affected.