CVE-2026-81020 wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-81020?
CVE-2026-81020 is a high-severity vulnerability in wolfSSL Inc. wolfEngine, published on 28 Aug 2026.
Official description
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
Weakness: CWE-323
Which versions are affected by CVE-2026-81020?
It affects 1 product.
Products include Wolfssl Wolfengine.
How do I fix CVE-2026-81020?
No fix has been published for CVE-2026-81020 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-81020 being exploited?
There is no known exploitation of CVE-2026-81020 in the wild and no public exploit code.
Other vulnerabilities in wolfSSL Inc. wolfEngine
Sources
Also known as GHSA-8x67-443h-6cwx.