EUVD-2026-53299
GHSA-v6xc-r9wm-438j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:X/U:Amber
Network-reachable but requires authorized access (PR:L), feature-specific conditions and sustained throughput (AC:H), with only partial confidentiality loss (C:L) and no integrity or availability impact.
Primary rating from Vendor (02762ae7-200e-4b20-9b2b-a77d5b8fc4cb).
CVSS VectorVendor: 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
Lifecycle Timeline
2DescriptionCVE.org
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled.
If a producer sends messages at a sustained high rate without key rotation, which only occurs on reboot of the Kong Event Gateway instance, the probability of a nonce collision becomes non-negligible. An authorized consumer who detects a nonce collision can recover parts of plaintext from the affected messages.
New versions 1.1.2 and 1.2.1 enforce automatic key rotation before the recommended usage limit is reached.
AnalysisAI
AES-GCM nonce exhaustion in Kong Event Gateway 1.0.0-1.1.1 and 1.2.0 allows an authorized consumer to recover partial message plaintext when the AWS IAM encryption feature is enabled and key rotation has not occurred. Because keys are only rotated on gateway reboot, a producer sustaining a high message rate can exhaust the NIST SP 800-38D-recommended random nonce limit (~2^32 encryptions), making nonce collisions statistically likely and enabling ciphertext XOR attacks. No public exploit exists and the vulnerability is not in CISA KEV; the CVSS 4.0 score of 2.3 reflects the narrow, condition-heavy exploitation path.
Technical ContextAI
AES-GCM (Galois/Counter Mode) is an authenticated encryption scheme whose security depends critically on nonce uniqueness per key. NIST SP 800-38D constrains random 96-bit nonces to approximately 2^32 invocations per key before collision probability becomes non-negligible (birthday bound). Kong Event Gateway's AWS IAM encryption feature uses AES-GCM with random nonces but tied key lifetime to gateway instance lifetime rather than invocation count, violating this constraint under high-throughput workloads. CWE-323 (Reusing a Nonce, Key Pair in Encryption) is the exact root cause: when two messages share the same key-nonce pair, an adversary can XOR their ciphertexts, cancelling the keystream and revealing the XOR of the two plaintexts, enabling partial plaintext recovery. The affected product is Kong Event Gateway (not the broader Kong API Gateway), a message-bus style component.
RemediationAI
Upgrade to Kong Event Gateway 1.1.2 (for the 1.1.x branch) or 1.2.1 (for the 1.2.x branch), which enforce automatic key rotation before the NIST SP 800-38D recommended nonce usage limit is reached, eliminating the vulnerability. Patch details are documented in the official changelog at https://developer.konghq.com/event-gateway/changelog/. As a compensating control for operators unable to upgrade immediately, scheduling periodic planned reboots of the Kong Event Gateway instance will force key rotation and reset the nonce counter; the appropriate interval depends on message throughput - at very high rates (millions of messages per day), daily reboots may be necessary. Disabling the AWS IAM encryption feature entirely eliminates the attack surface if that feature is not operationally required, though this removes at-rest and in-transit encryption protections and should be weighed carefully. No workaround fully replicates the automatic rotation introduced in the patched versions.
Same weakness CWE-323 – Reusing a Nonce, Key Pair in Encryption
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today