Pion DTLS (Go): six advisories including two critical (CVSS 9.1) client-authentication bypass and peer-impersonation flaws found by Anthropic's OSS Scanner — upgrade to v3.1.14; v2 has no fixed release

The maintainers of Pion DTLS, the Go DTLS library used by the pion/webrtc stack and many Go real-time and IoT services, published six GitHub security advisories on 16 October 2026, all credited to Anthropic's OSS Scanner. GHSA-7c2r-jhm9-43vf (critical, CVSS 3.1 9.1) lets an attacker who can redirect a DTLS handshake and has the peer's public certificate impersonate that peer without its private key, because the library chose the verification primitive from the certificate's key type but took the digest from the attacker-controlled signature scheme; the maintainers note that checking the WebRTC SDP certificate fingerprint does not stop it, since the genuine certificate is presented. GHSA-hhpj-h56m-9f2p (critical, 9.1) lets an unauthenticated client skip required client-certificate checks by resuming a DTLS 1.2 session the server cached before the original handshake finished. GHSA-cqhp-ggp7-58qj (high, 7.4) is a similar bypass when an application shares one session store between its outbound connections and its listener. The other three are denial-of-service bugs: an unbounded handshake cache (memory exhaustion), oversized peer RSA keys (CPU exhaustion), and repeated client-certificate verification while the server waits for the client's Finished message. The maintainers say the two session-resumption bypasses do not affect pion/webrtc users, but the impersonation flaw and the DoS bugs can reach WebRTC applications acting as the DTLS server. No CVE IDs were listed at publication and no exploitation is reported. Fixes shipped in v3.1.13 (16 Oct) and v3.1.14 (16 Oct, the session-store fixes); the advisories list no patched v2 release. Primary: Pion DTLS GitHub security advisories; context: maintainer post on Hacker News (16 Oct).

Product

Pion DTLS (github.com/pion/dtls), used by pion/webrtc and other Go real-time services

Versions

Affected: dtls/v3 before 3.1.13 (impersonation and DoS advisories) or before 3.1.14 (session-store bypasses); dtls/v2 2.0.0-2.2.12 (bypasses from 2.1.0); legacy github.com/pion/dtls 1.2.2-1.5.4 for the certificate re-verification DoS. Fixed: v3.1.14. No patched v2 release listed.

CVSS

9.1 Critical (GHSA-7c2r-jhm9-43vf, GHSA-hhpj-h56m-9f2p); 7.4 High (GHSA-cqhp-ggp7-58qj); three further High/Moderate DoS advisories without a published score

Exploited in Australia?

unknown

Patch to

Update Go modules to github.com/pion/dtls/v3 v3.1.14 (and a pion/webrtc release that pulls it in), rebuild and redeploy. Projects still on dtls/v2 should migrate to v3, since no fixed v2 release is listed. Until patched, avoid sharing one SessionStore between outbound and inbound DTLS connections and do not rely on DTLS session resumption for client-certificate authentication.

Primary: Pion DTLS — GHSA-7c2r-jhm9-43vf: handshake signature scheme confusion allows peer impersonation (16 Oct 2026) · Vendor: Pion DTLS — GHSA-hhpj-h56m-9f2p: client auth bypass via premature DTLS 1.2 session caching (16 Oct 2026) · Hacker News — Pion maintainer: Anthropic found 36 bugs (6 security) in Pion DTLS (16 Oct 2026)

vulnerabilities network