🛡️ CVE-2026-26014 — dtls
Description
Pion DTLS's usage of random nonce generation with AES GCM ciphers risks leaking the authentication key
Impact
Pion DTLS versions v1.0.0 through v3.0.10 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack".
Patches
Upgrade to v3.1.1 or later. This version includes PR #796, which uses the 64-bit sequence number to populate the nonce_explicit part of the GCM nonce. This is according to best practice outlined in [RFC 9325 section 7.2.1](https://www.rfc-editor.org/rfc/rfc9325#section-7.2.1).
v3.0.11 is a backport patch supporting Go v1.21
Workarounds
There are no workarounds without upgrading to version v3.0.11, v3.1.1 or later.
References
Commit fixing the bug: https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f
Commit fixing the bug (backport): 90e241c
Pull request: #796
How this vulnerability can be exploited
This issue can be reached over the network, attack complexity is high, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality high, integrity none, availability none.
Weakness class
CVE-2026-26014 is classified as CWE-200: Exposure of Sensitive Information. Information that should stay internal is disclosed to someone who is not authorised to see it.
Affected software
CVE-2026-26014 is recorded against 4 packages.
- dtls (fixed in 3.1.0)
- github.com/pion/dtls
- github.com/pion/dtls/v2
- github.com/pion/dtls/v3
Timeline and source
Published on 11 February 2026 and last revised on 17 June 2026. No public exploit is currently recorded for this entry. A vendor advisory or fix has been published. Record sourced from NVD.
References
github.com
github.com
github.com
github.com
github.com
github.com
CVE-2026-26014 on other distributions
Each distribution ships its own build and its own fixed version. Pick the one you run:
Details
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| dtls | — | 3.1.0 |
| github.com/pion/dtls | — | — |
| github.com/pion/dtls/v2 | — | — |
| github.com/pion/dtls/v3 | — | — |
References
Similar Threats
- Medium CVE-2022-29189
- High CVE-2022-29190
- Medium CVE-2022-29222
More CVE 2026 advisories
Browse all of CVE 2026 in the advisory index.
Vulnerability Monitoring
Track new vulnerabilities in dtls
CVE-2026-26014 is rated CVSS 5.9 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.
Set Up Free Alerts →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.