CVE-2026-81020: CWE-323 Reusing a Nonce, Key Pair in Encryption in wolfSSL Inc. wolfEngine

wolfEngine before version 1.4.1 improperly handles the AES-GCM nonce in TLS 1.2 and DTLS 1.2 by generating the explicit 8-byte nonce once when the TLS write key is set and failing to increment it for each record. This results in every AES-GCM record within a connection being encrypted with the same key and nonce pair. Reusing a GCM key and nonce pair compromises confidentiality by disclosing the keystream (since XOR of ciphertexts reveals XOR of plaintexts) and leaks the GHASH authentication key, which can be exploited to forge authentication tags. The issue does not affect AES-CCM, TLS 1.3, or non-TLS uses of the cipher.

An attacker who can observe multiple TLS 1.2 or DTLS 1.2 AES-GCM encrypted records within a single connection can exploit the nonce reuse to recover plaintext data and forge authentication tags. This compromises the confidentiality and integrity of the affected communications. The vulnerability does not impact AES-CCM, TLS 1.3, or non-TLS cipher uses.

No official patch or remediation level is currently confirmed. Users should upgrade to wolfEngine version 1.4.1 or later once available, as versions up to 1.4.0 are affected. Until then, avoid using TLS 1.2 or DTLS 1.2 AES-GCM modes with wolfEngine or apply alternative mitigations if possible. Monitor the vendor advisory for updates on fixes.