CVE-2026-81020

Name of the Vulnerable Software and Affected Versions wolfEngine versions prior to 1.4.1

Description wolfEngine fails to increment the 8-byte explicit AES-GCM nonce for each record, generating it only once when the TLS write key is set. Consequently, all TLS 1.2 and DTLS 1.2 AES-GCM records within a single connection use the same key and nonce pair. This reuse discloses the keystream, allowing an attacker to recover plaintexts if one record is known, and leaks the GHASH authentication key, which enables authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS implementations of the cipher are not affected.

Recommendations Update to version 1.4.1.