CVE-2026-81341: wolfEngine reuses the AES-CCM nonce on TLS 1.2 / DTLS 1.2 records
wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the additional authenticated data. Because the record layer leaves the explicit-nonce field for the cipher to populate, the value read is constant across records, so every AES-CCM record within a connection is encrypted under an identical key and nonce pair. Reusing a CCM key and nonce weakens confidentiality (identical keystream across records, so a known record recovers the others) and integrity (authentication tag forgery). Only wolfEngine is affected; wolfProvider is not. AES-GCM under wolfEngine is tracked separately. AES-CCM cipher suites are not enabled by default and must be explicitly selected, which limits exposure. TLS 1.3 and non-TLS use of the cipher are not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wolfEngineto a version that resolves this vulnerability.Fixed in 1.4.1 - Configuration
As an interim mitigation, do not enable AES-CCM cipher suites (do not select them), since they are not enabled by default.
TLS configuration AES-CCM cipher suites enablement = do not enable - Configuration
As an interim mitigation, use TLS 1.3 instead of TLS 1.2 for affected deployments.
TLS configuration Protocol version = use TLS 1.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Only wolfEngine deployments before 1.4.1 that explicitly select AES-CCM cipher suites for TLS 1.2 or DTLS 1.2 are affected. AES-CCM suites are not enabled by default, and wolfProvider, TLS 1.3, and non-TLS cipher use are not affected.
What does an attacker need to exploit the issue?
The issue affects multiple AES-CCM records within the same connection because they are encrypted with the same key and nonce pair. A known record can recover other records' confidentiality, and nonce reuse also enables authentication-tag forgery.