---
id: CVE-2021-28681
aliases:
  - GHSA-74xm-qj29-cq8p
  - GO-2021-0104
title: >-
  In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop
  data channel communication
summary: >-
  In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop
  data channel communication
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
vendor: pion
product: github.com/pion/webrtc/v3
ecosystem: go
affected:
  - github.com/pion/webrtc/v3 < 3.0.15
patched:
  - github.com/pion/webrtc/v3 3.0.15
published: '2021-05-25'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-74xm-qj29-cq8p'
references:
  - url: 'https://github.com/pion/webrtc/security/advisories/GHSA-74xm-qj29-cq8p'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-28681'
  - url: 'https://github.com/pion/webrtc/issues/1708'
  - url: 'https://github.com/pion/webrtc/pull/1709'
  - url: >-
      https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e
  - url: 'https://github.com/pion/webrtc'
  - url: 'https://pkg.go.dev/vuln/GO-2021-0104'
tags:
  - osv
  - go
epss: 0.00677
epssPercentile: 0.50211
ingestedAt: '2026-07-09T18:56:36.030Z'
---

## Overview

### Impact
Data channel communication was incorrectly allowed with users who have failed DTLS certificate verification.

This attack requires 
* Attacker knows the ICE password. 
* Only take place during PeerConnection handshake.

This attack can be detected by monitoring `PeerConnectionState` in all versions of Pion WebRTC.

### Patches
Users should upgrade to v3.0.15. 

The exact patch is https://github.com/pion/webrtc/commit/545613dcdeb5dedb01cce94175f40bcbe045df2e

### Workarounds
Users should listen for when `PeerConnectionState` changes to `PeerConnectionStateFailed`. When it enters this state users should not continue using the PeerConnection.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/pion/webrtc
* Email us at [team@pion.ly](mailto:team@pion.ly)

Thank you to https://github.com/Gaukas for discovering this.

## Affected packages

- `github.com/pion/webrtc/v3 < 3.0.15`

## Remediation

Upgrade to a patched release:

- `github.com/pion/webrtc/v3 3.0.15`