Description
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pion | dtls | < 2.1.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | snowflake | 2.2.0-1 | — |
| Debian 13 | snowflake | 2.2.0-1 | — |
| Debian 12 | snowflake | 2.2.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | snowflake | 1.1.0-2ubuntu0.1+esm2 | USN-7966-1 |
| Ubuntu Pro 22.04 LTS | telegraf | 1.21.4+ds1-0ubuntu2+esm2 | USN-7966-2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/pion/dtls | < 2.1.5 | 2.1.5 | GHSA-w45j-f832-hxvh |
| Go | github.com/pion/dtls/v2 | < 2.1.5 | 2.1.5 | GHSA-w45j-f832-hxvh |
Advisories 2
- USN-7966-2 telegraf vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-7966-1 snowflake vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026