CVE-2026-26014

medium

Description

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". Upgrade to v3.0.11, v3.1.1, or later.

References

https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r

https://github.com/pion/dtls/releases/tag/v3.1.1

https://github.com/pion/dtls/releases/tag/v3.0.11

https://github.com/pion/dtls/pull/796

https://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6

https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-6169

Details

Source: Mitre, NVD

Published: 2026-02-11

Updated: 2026-02-25

Named Vulnerability: GO-2026-4479Named Vulnerability: GHSA-9f3f-wv7r-qc8r

Risk Information

CVSS v2

Base Score: 5.4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.9

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: Medium

EPSS

EPSS: 0.00772