Executive brief
wolfEngine is a cryptographic module used to secure TLS and DTLS communications. In versions before 1.4.1, when AES-CCM encryption is explicitly selected, the software reuses identical encryption keys and nonces across multiple records within the same connection. This nonce reuse weakens both the confidentiality of encrypted data (allowing attackers to recover plaintext from multiple records) and the integrity of authentication tags (making it possible to forge valid signatures). The vulnerability requires explicit configuration of AES-CCM cipher suites, which are not enabled by default.
Technical details
wolfEngine sources the explicit AES-CCM nonce from the record input buffer instead of deriving it from the TLS sequence number in the additional authenticated data (AAD). Because the record layer leaves the explicit-nonce field for the cipher to populate, the value read is constant across records, resulting in key-nonce pair reuse. Reusing a CCM key and nonce produces identical keystreams across records, so an attacker who knows the plaintext of one record can recover the plaintext of others. Additionally, nonce reuse breaks CCM's authentication tag integrity, enabling authentication tag forgery. The vulnerability affects only wolfEngine (not wolfProvider), only explicit AES-CCM cipher suites (not AES-GCM), and only TLS 1.2 and DTLS 1.2 (not TLS 1.3 or non-TLS uses). Since AES-CCM suites are not enabled by default, exposure is limited to users who explicitly configure them.
Affected products
- wolfSSL wolfEngine before 1.4.1
Timeline
- 2026-08-28: disclosed