CVE-2026-26014
Last modified
CVE-2026-26014 is a medium-severity vulnerability rated 5.9/10 on the CVSS scale. Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". EPSS estimates a 0.62% chance of exploitation in the next 30 days.
Description
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". Upgrade to v3.0.11, v3.1.1, or later.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pion | Dtls | < 3.1.0 |
References
- https://github.com/pion/dtls/pull/796Issue Tracking
- https://github.com/pion/dtls/releases/tag/v3.0.11Release Notes
- https://github.com/pion/dtls/releases/tag/v3.1.1Release Notes
- https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8rPatch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-26014?
How severe is CVE-2026-26014?
How do I fix CVE-2026-26014?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-26009Catalyst is a platform built for enterprise game server host…9.9
- CVE-2026-2601GitLab has remediated an issue in GitLab EE affecting all ve…4.3
- CVE-2026-26010OpenMetadata is a unified metadata platform. Prior to 1.11.8…7.6
- CVE-2026-26011navigation2 is a ROS 2 Navigation Framework and System. In 1…9.8
- CVE-2026-26012vaultwarden is an unofficial Bitwarden compatible server wri…6.5
- CVE-2026-26013LangChain is a framework for building agents and LLM-powered…3.7
- CVE-2026-26015DocsGPT is a GPT-powered chat for documentation. From versio…9.8
- CVE-2026-26016Wings is the server control plane for Pterodactyl, a free, o…8.1
- CVE-2026-26017CoreDNS is a DNS server that chains plugins. Prior to versio…6.3
- CVE-2026-26018CoreDNS is a DNS server that chains plugins. Prior to versio…7.5
- CVE-2026-26019LangChain is a framework for building LLM-powered applicatio…4.1
- CVE-2026-2602The Twentig plugin for WordPress is vulnerable to Stored Cro…6.4
Are you affected by CVE-2026-26014?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST