CVE-2026-26014

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". Upgrade to v3.0.11, v3.1.1, or later.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f	Patch
https://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6	Patch
https://github.com/pion/dtls/pull/796	Issue Tracking
https://github.com/pion/dtls/releases/tag/v3.0.11	Release Notes
https://github.com/pion/dtls/releases/tag/v3.1.1	Release Notes
https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pion:dtls:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-02-11 21:16

Updated : 2026-06-17 10:25

NVD link : CVE-2026-26014

Mitre link : CVE-2026-26014

CVE.ORG link : CVE-2026-26014

JSON object : View

Products Affected

pion

dtls

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

NVD-CWE-noinfo

{"id": "CVE-2026-26014", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26014", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-12T21:23:09.377889Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pion", "product": "dtls", "versions": [{"status": "affected", "version": "= 3.1.0"}, {"status": "affected", "version": "< 3.0.11"}]}]}], "published": "2026-02-11T21:16:21.257", "references": [{"url": "https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pion/dtls/pull/796", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pion/dtls/releases/tag/v3.0.11", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pion/dtls/releases/tag/v3.1.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a \"forbidden attack\". Upgrade to v3.0.11, v3.1.1, or later."}, {"lang": "es", "value": "Pion DTLS es una implementaci\u00f3n en Go de Datagram Transport Layer Security. Las versiones v1.0.0 a v3.0.10 y 3.1.0 de Pion DTLS usan generaci\u00f3n de nonce aleatorio con cifrados AES GCM, lo que facilita a los atacantes remotos obtener la clave de autenticaci\u00f3n y falsificar datos aprovechando la reutilizaci\u00f3n de un nonce en una sesi\u00f3n y un 'ataque prohibido'. Actualice a v3.0.11, v3.1.1, o posterior."}], "lastModified": "2026-06-17T10:25:36.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pion:dtls:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "637DA08C-B336-461A-88BE-F52B88D93F00", "versionEndExcluding": "3.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}