CVE-2026-81020: wolfEngine reuses the AES-GCM nonce on every TLS 1.2 / DTLS 1.2 record
Vulnerability summary
CVE-2026-81020 is a high (CVSS 7.4) Reusing a Nonce, Key Pair in Encryption vulnerability in wolfssl inc. wolfengine. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 32.4% of scored vulnerabilities.
Severe, CVSS 7.4 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 28-08-2026PublishedVulnerability first disclosed.
- 28-08-2026Last modifiedVulnerability information updated.
Description
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.38% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Wolfssl1 product
- wolfengine< 1.4.1
Wolfssl inc.1 product
- wolfengine≤ 1.4.0
2 vendors · 2 products
References
1 links- www.wolfssl.com/docs/security-vulnerabilities/Vendor Advisory