Read the docs
TI-2019-15006 Aliases CVE-2019-20786GHSA-7gfg-6934-mqq2

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application…

Priority MEDIUM 48CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.

Why it matters now

EPSS 0.03012 87th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/pion/dtls (Go): 1.5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/pion/dtls (Go)before 1.5.21.5.2Patch availableGHSA-7gfg-6934-mqq2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/pion/dtls (Go) Vendor— Affected before 1.5.2 Fixed in 1.5.2 Patch available GHSA-7gfg-6934-mqq2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pion:dtls:*:*:*:*:*:*:*:*before 1.5.2Vulnerablepion
  • cpe:2.3:a:pion:dtls:*:*:*:*:*:*:*:* Versions before 1.5.2 Vulnerable ·pion

Remediation

  • Fix · GHSA-7gfg-6934-mqq2 github.com/pion/dtls (Go) Fixed in 1.5.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-20786
  2. 2026-10-03 Alias added: GHSA-7gfg-6934-mqq2

References

Exploit 1

Patch 2

Advisory 2

Other 3

  • TI-2022-11733 Header reconstruction method can be thrown into an infinite loop in Pion DTLS CVSS 3.1HIGH 7.5
  • TI-2022-11765 Improper Certificate Validation in Pion DTLS CVSS 3.1HIGH 7.5
  • TI-2022-11732 Buffer for inbound DTLS fragments has no limit CVSS 3.1MEDIUM 5.3
  • TI-2026-21028 Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key CVSS 3.1MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences