EUVD-2026-67737
GHSA-8x67-443h-6cwx
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network vector for passive TLS interception; AC:H for multi-record capture requirement; PR:N as no authentication to target system is needed; C:H and I:H for full plaintext recovery and tag forgery; no availability impact.
Primary rating from Vendor (wolfSSL).
CVSS VectorVendor: wolfSSL
Lifecycle Timeline
2DescriptionCVE.org
wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.
AnalysisAI
AES-GCM nonce reuse in wolfEngine before 1.4.1 allows a network-positioned passive adversary to fully recover encrypted plaintext and forge authentication tags across all TLS 1.2 and DTLS 1.2 sessions. The 8-byte explicit nonce is generated once at TLS write-key setup and never incremented per record, meaning every GCM record within a connection shares an identical (key, nonce) pair - a catastrophic misuse of authenticated encryption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must use wolfEngine (not native OpenSSL or standalone wolfSSL) as its registered OpenSSL engine, and the TLS session must negotiate TLS 1.2 or DTLS 1.2 with an AES-GCM cipher suite - this is a common default cipher suite selection and requires no non-default configuration to trigger. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.4 score with AC:H reflects that exploitation requires a network-positioned attacker able to observe multiple records from the same TLS 1.2 or DTLS 1.2 session - not a trivial precondition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade wolfEngine to version 1.4.1 or later, per the wolfSSL security advisory at https://www.wolfssl.com/docs/security-vulnerabilities/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete asset inventory to identify all systems running wolfEngine and determine affected versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wolfengine
View allSame weakness CWE-323 – Reusing a Nonce, Key Pair in Encryption
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today