Buffer for inbound DTLS fragments has no limit
Priority LOW 34CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02149 82nd percentileScored 2026-11-07
Fix Fixed dtls (pion): 2.1.4github.com/pion/dtls (Go): 2.1.4+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pion | dtls | before 2.1.4 | 2.1.4 | Patch available | CNA |
| — | github.com/pion/dtls (Go) | before 2.1.4 | 2.1.4 | Patch available | GHSA-cx94-mrg9-rq4j |
| — | github.com/pion/dtls/v2 (Go) | before 2.1.4 | 2.1.4 | Patch available | GHSA-cx94-mrg9-rq4j |
- dtls Vendorpion Affected before 2.1.4 Fixed in 2.1.4 Patch available CNA
- github.com/pion/dtls (Go) Vendor— Affected before 2.1.4 Fixed in 2.1.4 Patch available GHSA-cx94-mrg9-rq4j
- github.com/pion/dtls/v2 (Go) Vendor— Affected before 2.1.4 Fixed in 2.1.4 Patch available GHSA-cx94-mrg9-rq4j
Remediation
- Fix · CNA dtls (pion) Fixed in 2.1.4
- Fix · GHSA-cx94-mrg9-rq4j github.com/pion/dtls (Go) Fixed in 2.1.4 Advisory →
- Fix · GHSA-cx94-mrg9-rq4j github.com/pion/dtls/v2 (Go) Fixed in 2.1.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-29189
- 2026-10-03 Alias added: GHSA-cx94-mrg9-rq4j
References
More pion Dtls vulnerabilities
- TI-2019-15006 handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application… CVSS 3.1CRITICAL 9.8
- TI-2022-11733 Header reconstruction method can be thrown into an infinite loop in Pion DTLS CVSS 3.1HIGH 7.5
- TI-2022-11765 Improper Certificate Validation in Pion DTLS CVSS 3.1HIGH 7.5
- TI-2026-21028 Pion DTLS uses random nonce generation with AES GCM ciphers risks leaking the authentication key CVSS 3.1MEDIUM 5.9
Sources
- CVE-2022-29189 · CVE Program
- CVE-2022-29189 · NVD
- FIRST EPSS
- GHSA-cx94-mrg9-rq4j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences