CVE-2026-81341: CWE-323 Reusing a Nonce, Key Pair in Encryption in wolfSSL Inc. wolfEngine

In wolfEngine versions up to 1.4.0, the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records is sourced from the record input buffer instead of the TLS sequence number in the additional authenticated data. Since the record layer expects the cipher to populate the explicit-nonce field, the value read remains constant across records. This results in every AES-CCM record within a connection being encrypted under the same key and nonce pair. Reusing a CCM key and nonce compromises confidentiality by producing identical keystreams across records, allowing recovery of other records if one is known, and weakens integrity by enabling authentication tag forgery. This vulnerability affects only wolfEngine and not wolfProvider, and only when AES-CCM cipher suites are explicitly enabled. TLS 1.3 and non-TLS uses of the cipher are unaffected.

The vulnerability allows attackers to compromise confidentiality and integrity of TLS 1.2 and DTLS 1.2 communications encrypted with AES-CCM in affected wolfEngine versions. Confidentiality is weakened because the same key and nonce reuse leads to identical keystreams, enabling recovery of plaintext from other records if one record is known. Integrity is weakened due to the possibility of authentication tag forgery. However, exposure is limited because AES-CCM cipher suites are not enabled by default and must be explicitly selected. TLS 1.3 and non-TLS uses are not impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using AES-CCM cipher suites with wolfEngine versions up to 1.4.0. Prefer TLS 1.3 or other cipher suites not affected by this issue. Monitor vendor communications for updates and apply official patches once released.