CVE-2022-29189CWE-120

Buffer for inbound DTLS fragments has no limit

Medium · published May 20, 2022

CVSS v3.1
5.3
EPSS
2%
Percentile
82.0
In the wild
Unconfirmed
What it is

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or timed out. An attacker could exploit this to cause excessive memory usage. Version 2.1.4 contains a patch for this issue. There are currently no known workarounds available.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.02149 · 82.0th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2022-05-20T23:55Z
EPSS history
Timeline
  • 20 MAY 23:55Z
    Buffer for inbound DTLS fragments has no limit
    cvelistv5