CVE-2019-20786: Improper Authentication in Pion DTLS
Summary
CVE-2019-20786: Improper authentication in github.com/pion/dtls. Affects github.com/pion/dtls versions < 1.5.2. Fixed in 1.5.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pion DTLS is a Go library that provides Datagram Transport Layer Security (DTLS) functionality. It is used for securing communication channels that transmit data over UDP. DTLS is a variant of the Transport Layer Security (TLS) protocol specifically designed for unreliable datagram protocols. Pion DTLS allows developers to implement DTLS in their Go applications.
Vulnerability Detail
The vulnerability identified as CVE-2019-20786 in Pion DTLS before version 1.5.2 is an improper authentication issue. The handleIncomingPacket function in conn.go does not check for application data with epoch 0, allowing remote attackers to inject arbitrary unencrypted data after the handshake is completed. This vulnerability can be exploited to tamper with the integrity and confidentiality of the communication, potentially leading to unauthorized access or data manipulation.
How To Fix
Latest published version: v1.5.4 as of 23 Oct 2026
go get github.com/pion/dtls@v1.5.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.2
This is the first release that contains the fix.
go get github.com/pion/dtls@v1.5.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability identified as CVE-2019-20786 in Pion DTLS before version 1.5.2 allows remote attackers to inject arbitrary unencrypted data after the handshake is completed. To mitigate this vulnerability, it is crucial to update the Pion DTLS package to version 1.5.2 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/pion/dtls →
FAQ
Pion DTLS is a Go library that provides Datagram Transport Layer Security (DTLS) functionality. It allows developers to implement DTLS in their Go applications for securing communication channels that transmit data over UDP.
The vulnerability allows remote attackers to inject arbitrary unencrypted data after the handshake is completed. This can lead to tampering with the integrity and confidentiality of the communication, potentially resulting in unauthorized access or data manipulation.
To fix this vulnerability, update the Pion DTLS package to version 1.5.2 or later. This version includes the necessary check for application data with epoch 0, preventing the injection of arbitrary unencrypted data.
No specific workarounds have been provided for this vulnerability. It is recommended to update to the patched version of Pion DTLS.
For more information about this vulnerability, you can refer to the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-7gfg-6934-mqq2/GHSA-7gfg-6934-mqq2.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pion/dtls.
