Pion
5 CVEs across 3 Pion products. Browse Pion vulnerabilities, severities, and proof-of-concept exploits.
Pion products with known CVEs
Pion CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-54909 | Medium | 5.3 | 2026-07-31 | pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in… |
CVE-2026-54908 | | | 2026-07-01 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsi… |
CVE-2026-26014 | Medium | 5.9 | 2026-02-11 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Pion DTLS versions v1.0.0 through v3.0.10 and 3.1.0 use random nonce generation with AES… |
CVE-2025-49140 | High | 7.5 | 2025-06-09 | Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can b… |
CVE-2022-29222 | Medium | 5.9 | 2022-05-21 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses… |
CVE-2022-29190 | High | 7.5 | 2022-05-21 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infini… |
CVE-2022-29189 | Medium | 5.3 | 2022-05-21 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper… |
CVE-2019-20786 | Critical | 9.8 | 2020-04-19 | handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary un… |