CVE-2026-26014 | THREATINT

Description

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". Upgrade to v3.1.0 or later.

PUBLISHED Reserved 2026-02-09 | Published 2026-02-11 | Updated 2026-02-11 | Assigner GitHub_M

MEDIUM: 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Product status

< 3.1.0

affected

References

github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r

github.com/pion/dtls/pull/796

github.com/...ommit/61762dee8217991882c5eb79856b9e7a73ee349f

github.com/pion/dtls/releases/tag/v3.1.0

cve.org (CVE-2026-26014)

nvd.nist.gov (CVE-2026-26014)

Download JSON