Vulnerability Report: GO-2026-4479
- CVE-2026-26014, GHSA-9f3f-wv7r-qc8r
- Affects: github.com/pion/dtls, github.com/pion/dtls/v2, and 1 more
- Published: Feb 19, 2026
Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls
For detailed information about this vulnerability, visit https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r.
Affected Packages
-
PathGo VersionsSymbols
-
from v3.0.10 before v3.0.11, from v3.1.0 before v3.1.1
1 unexported affected symbols
- aead.encrypt
Affected Modules
-
PathGo Versions
-
all versions, no known fixed
-
all versions, no known fixed
Aliases
References
- https://github.com/pion/dtls/security/advisories/GHSA-9f3f-wv7r-qc8r
- https://github.com/pion/dtls/commit/61762dee8217991882c5eb79856b9e7a73ee349f
- https://github.com/pion/dtls/pull/796
- https://github.com/pion/dtls/releases/tag/v3.1.0
- https://vuln.go.dev/ID/GO-2026-4479.json
Feedback
See anything missing or incorrect?
Suggest an edit to this report.