CVE-2026-26014

CVE-2026-26014 is a medium-severity vulnerability affecting Pion DTLS versions v1.0.0 through v3.0.10 and v3.1.0, a Go implementation of Datagram Transport Layer Security. The flaw stems from insecure random nonce generation with AES GCM ciphers, allowing remote attackers to potentially obtain authentication keys and spoof data through nonce reuse within a session. While the attack complexity is high, successful exploitation could lead to significant confidentiality impacts. There is no evidence of active exploitation, and no public exploit code is available; however, it has garnered some community discussion and media coverage, indicating awareness.