CVE-2026-81020 wolfSSL Inc. CVE debrief

Who should care

Organizations using wolfEngine for TLS and DTLS connections should be aware of this vulnerability and take steps to update to a fixed version. This includes reviewing and updating TLS configurations to ensure secure cipher usage, monitoring for potential authentication tag forgery attempts, and ensuring that all affected systems are updated or mitigated. Security teams and vulnerability management teams should prioritize this vulnerability based on the potential impact on confidentiality and integrity of sensitive data. Additionally, operators of affected systems should verify that their configurations are secure and that compensating controls are in place if updates are not feasible in the short term.

Technical summary

The wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result, every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream and leaks the GHASH authentication key, enabling authentication tag forgery. This vulnerability affects TLS 1.2 and DTLS 1.2 AES-GCM records, and defenders should prioritize updating to version 1.4.1 or later.

Defensive priority

Organizations using wolfEngine should prioritize updating to version 1.4.1 or later to address the vulnerability.

Recommended defensive actions

• Update wolfEngine to version 1.4.1 or later
• Review and update TLS configurations to ensure secure cipher usage
• Monitor for potential authentication tag forgery attempts
• Perform vulnerability scanning to identify potentially affected systems
• Implement network monitoring to detect suspicious activity
• Review system logs for signs of exploitation
• Establish an incident response plan in case of a breach

Evidence notes

The wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. This results in every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection being encrypted under an identical key and nonce pair. To verify, defenders should review TLS configurations, check for potential authentication tag forgery attempts, and ensure updates to version 1.4.1 or later are applied. Evidence is limited to public CVE details and vendor advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.