CVE-2026-81020 Overview
CVE-2026-81020 affects wolfEngine versions before 1.4.1. The library generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. Every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream, since the XOR of two ciphertexts equals the XOR of their plaintexts. A single known record recovers the others and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS uses of the cipher are not affected. The issue is tracked as [CWE-323] (Reusing a Nonce, Key Pair in Encryption).
Critical Impact
A network attacker can recover plaintext from intercepted TLS 1.2 or DTLS 1.2 AES-GCM sessions and forge authenticated records against wolfEngine peers.
Affected Products
- wolfEngine versions prior to 1.4.1
- TLS 1.2 deployments using wolfEngine with AES-GCM cipher suites
- DTLS 1.2 deployments using wolfEngine with AES-GCM cipher suites
Discovery Timeline
- 2026-08-28 - CVE-2026-81020 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-81020
Vulnerability Analysis
AES-GCM requires that the (key, nonce) pair never repeat across encryptions. TLS 1.2 and DTLS 1.2 satisfy this requirement by constructing a 12-byte nonce from a 4-byte implicit salt and an 8-byte explicit counter that increments with each record. wolfEngine constructs the explicit portion of the nonce when the TLS write key is installed and reuses that same value for every subsequent record on the connection. The failure to increment produces identical (key, nonce) pairs across every record encrypted with that key.
GCM keystream is generated by encrypting a counter derived from the nonce under AES. When two records share a nonce, XORing the two ciphertexts yields the XOR of the two plaintexts. Recovery of one plaintext, for example a known HTTP header or handshake artifact, exposes all other plaintexts encrypted with the same nonce. The forbidden attack against GCM further recovers the GHASH subkey H from a pair of tagged messages, allowing an attacker to forge authentication tags on arbitrary ciphertexts. Confidentiality and integrity of the TLS record layer collapse.
Root Cause
The defect resides in the record-layer nonce management logic. The 8-byte explicit nonce is initialized once at key-setup time and is not advanced when each record is sealed. The intended behavior is to increment or otherwise ensure uniqueness for the explicit portion of the nonce on every record encryption, as required by RFC 5288 for TLS 1.2 AES-GCM cipher suites.
Attack Vector
A network-positioned attacker who can observe TLS 1.2 or DTLS 1.2 traffic to or from a wolfEngine peer captures two or more records that share a key and nonce. The attacker computes the XOR of the ciphertexts to recover plaintext relationships and uses the forbidden attack to recover H. With H recovered, the attacker forges valid GCM tags for injected ciphertexts, breaking record integrity. The high attack complexity reflects the need to capture, correlate, and process traffic for a target session rather than any exploitation gating on the peer.
No public exploit code is available for CVE-2026-81020 at this time. Refer to the WolfSSL Security Vulnerabilities advisory for authoritative technical details.
Detection Methods for CVE-2026-81020
Indicators of Compromise
- Repeated 8-byte explicit nonce values (bytes 5-12 of the 12-byte GCM nonce) observed across successive TLS 1.2 or DTLS 1.2 records within the same connection.
- Presence of wolfEngine builds earlier than 1.4.1 linked against OpenSSL as a TLS provider.
- Unexpected TLS record authentication failures on peers after intermittent traffic injection, indicative of forgery attempts.
Detection Strategies
- Inspect packet captures with tools such as Wireshark to compare the explicit nonce field of consecutive Application Data records; identical values on the same connection indicate the flaw.
- Inventory software builds and shared libraries to locate wolfEngine versions below 1.4.1.
- Correlate TLS handshake ServerHello cipher selection with endpoint software inventory to identify AES-GCM sessions terminated by vulnerable engines.
Monitoring Recommendations
- Log negotiated cipher suites and TLS versions at proxies and load balancers to identify TLS 1.2 or DTLS 1.2 AES-GCM sessions handled by wolfEngine.
- Alert on new deployments or containers that ship wolfEngine shared objects below 1.4.1.
- Retain full-packet capture on high-value TLS endpoints so nonce reuse can be verified during incident response.
How to Mitigate CVE-2026-81020
Immediate Actions Required
- Upgrade wolfEngine to version 1.4.1 or later on every host that loads the engine into OpenSSL.
- Rotate any long-lived TLS session keys, pre-shared keys, and certificates that may have been used with vulnerable builds.
- Audit dependent applications and container images to confirm they link against the fixed wolfEngine release.
Patch Information
The fix is delivered in wolfEngine 1.4.1, which restores per-record nonce construction consistent with RFC 5288. Consult the WolfSSL Security Vulnerabilities page for the vendor advisory and release notes.
Workarounds
- Disable TLS 1.2 and DTLS 1.2 AES-GCM cipher suites in the OpenSSL configuration where wolfEngine is loaded and negotiate AES-CCM suites instead, which are unaffected.
- Where feasible, require TLS 1.3, which is not affected by the flaw.
- Restrict access to services using wolfEngine to trusted networks until the update is deployed.
# Configuration example
# openssl.cnf snippet: prefer AES-CCM and disable AES-GCM while patching
[system_default_sect]
CipherString = TLSv1.2:!AES-GCM:+AES-CCM:@STRENGTH
MinProtocol = TLSv1.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
