PT-2026-7719 · Pion Dtls · Pion Dtls

Theodorsm · Published 2026-02-11 · Updated 2026-03-03 · CVE-2026-26014

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pion DTLS versions 1.0.0 through 3.1.0

Description Pion DTLS, a Go implementation of Datagram Transport Layer Security, is susceptible to an issue where the use of random nonce generation with AES GCM ciphers allows remote attackers to potentially obtain the authentication key and spoof data. This is possible due to nonce reuse in a session and a “forbidden attack”.

Recommendations Upgrade to version 3.1.0 or later. This version includes a fix that uses the 64-bit sequence number to populate the nonce explicit part of the GCM nonce. There are no workarounds without upgrading to version 3.1.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-26014

GHSA-9F3F-WV7R-QC8R

GO-2026-4479

SUSE-SU-2026:0757-1

Affected Products

Pion Dtls

References · 129

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26014.json · Exploit
• https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r · Vendor Advisory
• https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f · Patch
• https://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6 · Patch
• https://cve.org/CVERecord?id=CVE-2026-26014 · Security Note
• https://osv.dev/vulnerability/GHSA-9f3f-wv7r-qc8r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26014 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4479 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26014 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-26014 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-26014 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-26014 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-26014 · Vendor Advisory
• https://github.com/pion/dtls/pull/796 · Note