CVE-2026-26014mediumCWE-200

CVE-2026-26014: fallo de gravedad media en pion dtls

Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear dtls+ Monitorear github.com/pion/dtls

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.9epss 0.7%
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". Upgrade to v3.0.11, v3.1.1, or later.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
pion · dtls
CVEs relacionadas — pion dtls

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-29189MEDIUMBuffer for inbound DTLS fragments has no limitEPSS 2.1%CVE-2022-29190HIGHHeader reconstruction method can be thrown into an infinite loop in Pion DTLSEPSS 1.7%CVE-2022-29222MEDIUMImproper Certificate Validation in Pion DTLSEPSS 0.8%CVE-2026-54908MEDIUMPion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange messageEPSS 0.5%