CVE-2022-29222
Improper Certificate Validation in Pion DTLS
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Certificate Validation in Pion DTLS
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
- Record
CVE-2022-29222- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2022-5491
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
- Record
EUVD-2022-5491- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w45j-f832-hxvh
Pion/DLTS Accepts Client Certificates Without CertificateVerify
Impact
A DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it.
This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5
Patches
Upgrade to Pion DTLS v2.1.5
Workarounds
No workarounds available, upgrade to Pion DTLS v2.1.5
References
Thank you to Juho Nurminen and the Mattermost team for discovering and reporting this.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Pion DTLS
- Email us at [email protected]
- Record
GHSA-w45j-f832-hxvh- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
NVD
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
- Record
CVE-2022-29222- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
Improper Certificate Validation in Pion DTLS
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
- Record
CVE-2022-29222- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-29222
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
- Record
DEBIAN-CVE-2022-29222- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
Show 5 moreShow less
OSVGHSA-w45j-f832-hxvh
Pion/DLTS Accepts Client Certificates Without CertificateVerify
Impact
A DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it.
This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5
Patches
Upgrade to Pion DTLS v2.1.5
Workarounds
No workarounds available, upgrade to Pion DTLS v2.1.5
References
Thank you to Juho Nurminen and the Mattermost team for discovering and reporting this.
For more information
If you have any questions or comments about this advisory:
- Open an issue in Pion DTLS
- Email us at [email protected]
- Record
GHSA-w45j-f832-hxvh- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-29222
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to version 2.1.5. Users should upgrade to version 2.1.5 to receive a patch. There are currently no known workarounds.
- Record
UBUNTU-CVE-2022-29222- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGO-2022-0462 No score
Improper validation of client certificates in github.com/pion/dtls/v2
Client-provided certificates are not correctly validated, and must not be trusted.
DTLS client certificates must be accompanied by proof that the client possesses the private key for the certificate. The Pion DTLS server accepted client certificates unaccompanied by this proof, permitting an attacker to present any certificate and have it accepted as valid.
- Record
GO-2022-0462- Updated
- 2026-11-02
OSVUSN-7966-1 No score
snowflake vulnerabilities
It was discovered that Pion DTLS, vendored in Snowflake, did not impose a limit on the amount of data that was buffered during the handshake. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29189)
It was discovered that Pion DTLS, vendored in Snowflake, did not prevent the fragmentBuffer from processing zero length fragments. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29190)
It was discovered that Pion DTLS, vendored in Snowflake, did not require CertificateVerify when Client Cert was sent. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29222)
- Record
USN-7966-1- Updated
- 2026-11-02
OSVUSN-7966-2 No score
telegraf vulnerabilities
USN-7966-1 fixed vulnerabilities in Snowflake. This update provides the corresponding updates for Telegraf.
Original advisory details:
It was discovered that Pion DTLS, vendored in Telegraf, did not impose a limit on the amount of data that was buffered during the handshake. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29189)
It was discovered that Pion DTLS, vendored in Telegraf, did not prevent the fragmentBuffer from processing zero length fragments. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29190)
It was discovered that Pion DTLS, vendored in Telegraf, did not require CertificateVerify when Client Cert was sent. An attacker could possibly use the issue to cause a denial of service. (CVE-2022-29222)
- Record
USN-7966-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/pion/dtlsGo |
before 2.1.5 | 2.1.5 |
github.com/pion/dtls/v2Go |
before 2.1.5 | 2.1.5 |
snowflakeDebian:12 |
before 2.2.0-1 | 2.2.0-1 |
snowflakeDebian:13 |
before 2.2.0-1 | 2.2.0-1 |
snowflakeDebian:14 |
before 2.2.0-1 | 2.2.0-1 |
snowflakeUbuntu:Pro:22.04:LTS |
before 1.1.0-2ubuntu0.1+esm2, plus listed versions 1.1.0-11.1.0-21.1.0-2ubuntu0.11.1.0-2ubuntu0.1+esm1 |
1.1.0-2ubuntu0.1+esm2 |
telegrafUbuntu:Pro:22.04:LTS |
before 1.21.4+ds1-0ubuntu2+esm2, plus listed versions 1.19.2+ds1-0ubuntu11.21.2+ds1-0ubuntu11.21.4+ds1-0ubuntu11.21.4+ds1-0ubuntu2 |
1.21.4+ds1-0ubuntu2+esm2 |
snowflakeUbuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 1.1.0-2ubuntu0.1+esm2, plus listed versions 1.1.0-11.1.0-21.1.0-2ubuntu0.11.1.0-2ubuntu0.1+esm1 |
1.1.0-2ubuntu0.1+esm2 |
telegrafUbuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 1.21.4+ds1-0ubuntu2+esm2, plus listed versions 1.19.2+ds1-0ubuntu11.21.2+ds1-0ubuntu11.21.4+ds1-0ubuntu11.21.4+ds1-0ubuntu2 |
1.21.4+ds1-0ubuntu2+esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-29222 is a medium vulnerability (CVSS 5.9) in Pion Dtls, published May 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in github.com/pion/dtls 2.1.5.
References
github.com/pion/dtls/security/advisories/GHSA-w45j-f832-hxvh
nvd.nist.gov/vuln/detail/CVE-2022-29222
pkg.go.dev/vuln/GO-2022-0462
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2022-29222
ubuntu.com/security/CVE-2022-29222
cve.org/CVERecord?id=CVE-2022-29222