CVE-2026-26014

Katalog CVE

CVSS 5.9 · Medium EPSS 0,77%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada pion dtls. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack". Upgrade to v3.0.11, v3.1.1, or later.

Rincian

Terbit di NVD

11 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r patch · advisory vendor
• https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f patch
• https://github.com/pion/dtls/commit/90e241cfec2985715efdd3d005972847462a67d6 patch
• https://github.com/pion/dtls/pull/796 issue tracking
• https://github.com/pion/dtls/releases/tag/v3.0.11 release notes
• https://github.com/pion/dtls/releases/tag/v3.1.1 release notes