What’s Vulnerable › Vulnerabilities

CVE-2022-29189: Buffer for inbound DTLS fragments has no limit

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-21 · updated 2026-06-17
• Weakness: CWE-120

Description

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.

Affected products

• pion dtls: before 2.1.4 — fixed in 2.1.4

How to fix

Upgrade to a fixed version: pion dtls 2.1.4. Check the vendor advisory for mitigations.

References

• https://github.com/pion/dtls/commit/a6397ff7282bc56dc37a68ea9211702edb4de1de
• https://github.com/pion/dtls/releases/tag/v2.1.4
• https://github.com/pion/dtls/security/advisories/GHSA-cx94-mrg9-rq4j
• https://github.com/pion/dtls/commit/a6397ff7282bc56dc37a68ea9211702edb4de1de
• https://github.com/pion/dtls/releases/tag/v2.1.4
• https://github.com/pion/dtls/security/advisories/GHSA-cx94-mrg9-rq4j

Get alerted when CVE-2022-29189 or the next vulnerability affects your stack