In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication

MITTEL 5.3CVE-2021-28681 · GHSA-74xm-qj29-cq8p · GO-2021-0104 · Published 18/03/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-28681 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in github.com/pion/webrtc/v3, webrtc (webrtc project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.68%, höher als bei 52.5% aller Schwachstellen.
Abhilfe: auf 3.0.15 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/pion/webrtc/v3 Go	`< 3.0.15`	`3.0.15`
webrtc webrtc_project	`< 3.0.15`	`3.0.15`

Description

Impact

Data channel communication was incorrectly allowed with users who have failed DTLS certificate verification.

This attack requires

Attacker knows the ICE password.
Only take place during PeerConnection handshake.

This attack can be detected by monitoring PeerConnectionState in all versions of Pion WebRTC.

Patches

Users should upgrade to v3.0.15.

The exact patch is https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e

Workarounds

Users should listen for when PeerConnectionState changes to PeerConnectionStateFailed. When it enters this state users should not continue using the PeerConnection.

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/pion/webrtc
Email us at [email protected]

Thank you to https://github.com/Gaukas for discovering this.

NVD description

Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to continue if verification has failed.)

References

pion/webrtc security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-28681 · ADVISORY
pion/webrtc · WEB
pion/webrtc#1709 · WEB
pion/webrtc commit 545613d · WEB
pion/webrtc · PACKAGE
pkg.go.dev/vuln/GO-2021-0104 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/pion/webrtc/v3

< 3.0.15

3.0.15

webrtc

webrtc_project

< 3.0.15

3.0.15

Description

Impact

Data channel communication was incorrectly allowed with users who have failed DTLS certificate verification.

This attack requires

Attacker knows the ICE password.
Only take place during PeerConnection handshake.

This attack can be detected by monitoring PeerConnectionState in all versions of Pion WebRTC.

Patches

Users should upgrade to v3.0.15.

The exact patch is https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e

Workarounds

Users should listen for when PeerConnectionState changes to PeerConnectionStateFailed. When it enters this state users should not continue using the PeerConnection.

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/pion/webrtc
Email us at [email protected]

Thank you to https://github.com/Gaukas for discovering this.

NVD description