PT-2026-7719 · Pion Dtls · Pion Dtls

Theodorsm · Publicado 2026-02-11 · Atualizado 2026-03-03 · CVE-2026-26014

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pion DTLS versions 1.0.0 through 3.1.0

Description Pion DTLS, a Go implementation of Datagram Transport Layer Security, is susceptible to an issue where the use of random nonce generation with AES GCM ciphers allows remote attackers to potentially obtain the authentication key and spoof data. This is possible due to nonce reuse in a session and a “forbidden attack”.

Recommendations Upgrade to version 3.1.0 or later. This version includes a fix that uses the 64-bit sequence number to populate the nonce explicit part of the GCM nonce. There are no workarounds without upgrading to version 3.1.0 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

AZL-77645

AZL-77649

CVE-2026-26014

GHSA-9F3F-WV7R-QC8R

GO-2026-4479

SUSE-SU-2026:0757-1

Produtos afetados

Pion Dtls

Referências · 131

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26014.json · Exploit
• https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r · Aviso do Fabricante
• https://github.com/pion/dtls/pull/796 · Nota
• https://github.com/pion/dtls/releases/tag/v3.1.0 · Nota
• https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f · Correção
• https://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6 · Correção
• https://github.com/pion/dtls · Nota
• https://github.com/pion/dtls/releases/tag/v3.0.11 · Nota
• https://github.com/pion/dtls/releases/tag/v3.1.1 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26014 · Aviso do Fabricante
• https://twitter.com/_cvereports/status/2021776293507866859 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-27611 · Nota
• https://suse.com/security/cve/CVE-2017-18873 · Nota
• https://suse.com/security/cve/CVE-2026-26190 · Nota
• https://suse.com/security/cve/CVE-2026-25804 · Nota