CVE-2026-17578
Description
Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate without key rotation, which only occurs on reboot of the Kong Event Gateway instance, the probability of a nonce collision becomes non-negligible. An authorized consumer who detects a nonce collision can recover parts of plaintext from the affected messages. New versions 1.1.2 and 1.2.1 enforce automatic key rotation before the recommended usage limit is reached.
How to fix
- Kong Kong Event Gateway1.1.2, 1.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Kong Kong Event Gateway | 1.0.0 ≤ v < 1.1.2, 1.2.0 ≤ v < 1.2.1 | 1.1.2, 1.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.