GCVE - cpe:2.3:a:pion:dtls:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:pion:dtls:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Pion (`c3f16145-d38a-5a90-86b3-50acde6db724`)
Product	Dtls (`f7edaea5-8c9b-516e-bd89-449381996406`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/pion/dtls`	purl2cpe	2026-06-01 10:11:35.532503

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-54908`	vulnerable	2026-07-29 01:00:28.105838	Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4. Published: 2026-07-01T19:34:24.014Z Updated: 2026-07-02T15:54:54.578Z Open on db.gcve.eu Reference links https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j https://github.com/pion/dtls/pull/839	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-26014`	vulnerable	2026-06-08 07:53:20.720332	Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key MEDIUM (5.9) Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". Upgrade to v3.0.11, v3.1.1, or later. Published: 2026-02-11T21:07:50.187Z Updated: 2026-02-13T14:18:02.707Z Open on db.gcve.eu Reference links https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r https://github.com/pion/dtls/pull/796 https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f https://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6 https://github.com/pion/dtls/releases/tag/v3.0.11	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-29222`	vulnerable	2026-06-08 05:42:47.366755	Improper Certificate Validation in Pion DTLS MEDIUM (5.9) Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds. Published: 2022-05-21T00:00:15.000Z Updated: 2025-04-23T18:23:10.716Z Open on db.gcve.eu Reference links https://github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvh https://github.com/pion/dtls/commit/d2f797183a9f044ce976e6df6f362662ca722412 https://github.com/pion/dtls/releases/tag/v2.1.5	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-29190`	vulnerable	2026-06-08 05:42:47.304018	Header reconstruction method can be thrown into an infinite loop in Pion DTLS HIGH (7.5) Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infinite loop when processing. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available. Published: 2022-05-20T23:55:10.000Z Updated: 2025-04-23T18:23:25.844Z Open on db.gcve.eu Reference links https://github.com/pion/dtls/security/advisories/GHSA-cm8f-h6j3-p25c https://github.com/pion/dtls/commit/e0b2ce3592e8e7d73713ac67b363a2e192a4cecf https://github.com/pion/dtls/releases/tag/v2.1.4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-29189`	vulnerable	2026-06-08 05:42:47.303468	Buffer for inbound DTLS fragments has no limit MEDIUM (5.3) Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available. Published: 2022-05-20T23:55:16.000Z Updated: 2025-04-23T18:23:18.694Z Open on db.gcve.eu Reference links https://github.com/pion/dtls/releases/tag/v2.1.4 https://github.com/pion/dtls/security/advisories/GHSA-cx94-mrg9-rq4j https://github.com/pion/dtls/commit/a6397ff7282bc56dc37a68ea9211702edb4de1de	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-20786`	vulnerable	2026-06-08 05:13:41.570423	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.