Vulnerability Description
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate without key rotation, which only occurs on reboot of the Kong Event Gateway instance, the probability of a nonce collision becomes non-negligible. An authorized consumer who detects a nonce collision can recover parts of plaintext from the affected messages. New versions 1.1.2 and 1.2.1 enforce automatic key rotation before the recommended usage limit is reached.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-17578?
CVE-2026-17578 is a documented vulnerability. Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AW...
How severe is CVE-2026-17578?
CVSS scoring is not yet available for CVE-2026-17578. Check NVD for updates.
Is there a patch for CVE-2026-17578?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.