Description
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pion | dtls | < 2.1.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | snowflake | 2.2.0-1 | — |
| Debian 13 | snowflake | 2.2.0-1 | — |
| Debian 12 | snowflake | 2.2.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | snowflake | 1.1.0-2ubuntu0.1+esm2 | USN-7966-1 |
| Ubuntu Pro 22.04 LTS | telegraf | 1.21.4+ds1-0ubuntu2+esm2 | USN-7966-2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/pion/dtls | < 2.1.4 | 2.1.4 | GHSA-cx94-mrg9-rq4j |
| Go | github.com/pion/dtls/v2 | < 2.1.4 | 2.1.4 | GHSA-cx94-mrg9-rq4j |
Advisories 2
- USN-7966-2 telegraf vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-7966-1 snowflake vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026