{"id":"CVE-2021-28681","aliases":["GHSA-74xm-qj29-cq8p","GO-2021-0104"],"title":"In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication","summary":"In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","vendor":"pion","product":"github.com/pion/webrtc/v3","ecosystem":"go","affected":["github.com/pion/webrtc/v3 < 3.0.15"],"patched":["github.com/pion/webrtc/v3 3.0.15"],"published":"2021-05-25","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-74xm-qj29-cq8p","references":[{"url":"https://github.com/pion/webrtc/security/advisories/GHSA-74xm-qj29-cq8p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28681"},{"url":"https://github.com/pion/webrtc/issues/1708"},{"url":"https://github.com/pion/webrtc/pull/1709"},{"url":"https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e"},{"url":"https://github.com/pion/webrtc"},{"url":"https://pkg.go.dev/vuln/GO-2021-0104"}],"tags":["osv","go"],"epss":0.00677,"epssPercentile":0.50879,"ingestedAt":"2026-07-09T18:56:36.030Z","slug":"CVE-2021-28681","body":"## Overview\n\n### Impact\nData channel communication was incorrectly allowed with users who have failed DTLS certificate verification.\n\nThis attack requires \n* Attacker knows the ICE password. \n* Only take place during PeerConnection handshake.\n\nThis attack can be detected by monitoring `PeerConnectionState` in all versions of Pion WebRTC.\n\n### Patches\nUsers should upgrade to v3.0.15. \n\nThe exact patch is https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e\n\n### Workarounds\nUsers should listen for when `PeerConnectionState` changes to `PeerConnectionStateFailed`. When it enters this state users should not continue using the PeerConnection.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in https://github.com/pion/webrtc\n* Email us at [team@pion.ly](mailto:team@pion.ly)\n\nThank you to https://github.com/Gaukas for discovering this.\n\n## Affected packages\n\n- `github.com/pion/webrtc/v3 < 3.0.15`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/pion/webrtc/v3 3.0.15`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}