github.com/pion/dtls
DTLS 1.2 / 1.3 implementation for Go
View on Github
Activity
- Latest release
- 6y ago
- Total releases
- 20
- Cadence
- ~15 days
- Last 12 months
- 0
Reach
- Stars
- 698
Details
- First release
- Dec 04, 2018
| Version | Released | |
|---|---|---|
v1.5.4
patch
6 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.5.4
patch
Dependencies (3)
|
|
v1.5.3
patch
6 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.5.3
patch
Dependencies (3)
|
|
v1.5.2
patch
6 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.5.2
patch
Dependencies (3)
|
|
v1.5.1
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.5.1
patch
Dependencies (3)
|
|
v1.5.0
minor
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.5.0
minor
Dependencies (3)
|
|
v1.4.0
minor
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.4.0
minor
Dependencies (3)
|
|
v1.3.5
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.3.5
patch
Dependencies (3)
|
|
v1.3.4
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.3.4
patch
Dependencies (3)
|
|
v1.3.3
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.3.3
patch
Dependencies (3)
|
|
v1.3.2
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.3.2
patch
Dependencies (3)
|
|
v1.3.1
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.3.1
patch
Dependencies (3)
|
|
v1.3.0
minor
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.3.0
minor
Dependencies (3)
|
|
v1.2.3
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.2.3
patch
Dependencies (2)
|
|
v1.2.2
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.2.2
patch
Dependencies (2)
|
|
v1.2.1
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.2.1
patch
Dependencies (2)
|
|
v1.2.0
minor
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.2.0
minor
Dependencies (2)
|
|
v1.1.1
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.1.1
patch
Dependencies (2)
|
|
v1.1.0
minor
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.1.0
minor
Dependencies (2)
|
|
v1.0.2
patch
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.0.2
patch
|
|
v1.0.1
initial
7 CVEs
CVE-2026-26014
GO-2026-4479
GHSA-9f3f-wv7r-qc8r
Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls References Updated Feb 20, 2026 · Source: OSV.dev
GHSA-4xgv-j62q-h3rj
GO-2023-1534
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactDuring the unmarshalling of a hello verify request we could try to unmarshal into too small a buffer. is could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone, upgrade to 2.2.4 References Updated Nov 08, 2023 · Source: OSV.dev
GHSA-hxp2-xqf3-v83h
GO-2023-1535
Feb 07, 2023
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
None
High
ImpactWhen attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash. This issue could be abused to cause a denial of service. WorkaroundNone References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29222
GHSA-w45j-f832-hxvh
GO-2022-0462
May 25, 2022
Pion/DLTS Accepts Client Certificates Without CertificateVerify
5.9
/ 10
Medium
Network
High
None
None
Unchanged
None
High
None
ImpactA DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5 PatchesUpgrade to Pion DTLS v2.1.5 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.5 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.5
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29190
GHSA-cm8f-h6j3-p25c
GO-2022-0460
May 24, 2022
Pion DTLS Header reconstruction method can be thrown into an infinite loop
7.5
/ 10
High
Network
Low
None
None
Unchanged
None
None
High
ImpactAn attacker can send packets that will send Pion DTLS into an infinite loop when processing. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2022-29189
GHSA-cx94-mrg9-rq4j
GO-2022-0461
May 24, 2022
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
ImpactA buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage. PatchesUpgrade to Pion DTLS v2.1.4 WorkaroundsNo workarounds available, upgrade to Pion DTLS v2.1.4 ReferencesThank you to Juho Nurminen and the Mattermost team for discovering and reporting this. For more informationIf you have any questions or comments about this advisory:
Fixed in
2.1.4
References Updated Nov 08, 2023 · Source: OSV.dev
CVE-2019-20786
GHSA-7gfg-6934-mqq2
GO-2020-0038
Jun 29, 2021
Improper Authenication in Pion DTLS
9.8
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
High
handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion. Fixed in
1.5.2
References Updated Nov 08, 2023 · Source: OSV.dev |
v1.0.1
initial
|