FKIE_CVE-2026-26014

Vulnerability from fkie_nvd - Published: 2026-02-11 21:16 - Updated: 2026-02-25 17:40
Severity ?
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". Upgrade to v3.0.11, v3.1.1, or later.
References
security-advisories@github.comhttps://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349fPatch
security-advisories@github.comhttps://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6Patch
security-advisories@github.comhttps://github.com/pion/dtls/pull/796Issue Tracking
security-advisories@github.comhttps://github.com/pion/dtls/releases/tag/v3.0.11Release Notes
security-advisories@github.comhttps://github.com/pion/dtls/releases/tag/v3.1.1Release Notes
security-advisories@github.comhttps://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8rPatch, Vendor Advisory
Impacted products
Vendor Product Version
pion dtls *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pion:dtls:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "637DA08C-B336-461A-88BE-F52B88D93F00",
              "versionEndExcluding": "3.1.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a \"forbidden attack\". Upgrade to v3.0.11, v3.1.1, or later."
    },
    {
      "lang": "es",
      "value": "Pion DTLS es una implementaci\u00f3n en Go de Datagram Transport Layer Security. Las versiones v1.0.0 a v3.0.10 y 3.1.0 de Pion DTLS usan generaci\u00f3n de nonce aleatorio con cifrados AES GCM, lo que facilita a los atacantes remotos obtener la clave de autenticaci\u00f3n y falsificar datos aprovechando la reutilizaci\u00f3n de un nonce en una sesi\u00f3n y un \u0027ataque prohibido\u0027. Actualice a v3.0.11, v3.1.1, o posterior."
    }
  ],
  "id": "CVE-2026-26014",
  "lastModified": "2026-02-25T17:40:28.640",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-02-11T21:16:21.257",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/pion/dtls/pull/796"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/pion/dtls/releases/tag/v3.0.11"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/pion/dtls/releases/tag/v3.1.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.