modules:
  - module: github.com/pion/dtls/v2
    versions:
      - fixed: 2.1.4
    vulnerable_at: 2.1.3
    packages:
      - package: github.com/pion/dtls/v2
        symbols:
          - fragmentBuffer.push
        derived_symbols:
          - Client
          - ClientWithContext
          - Dial
          - DialWithContext
          - Resume
          - Server
          - ServerWithContext
          - handshakeFSM.Run
          - listener.Accept
description: |
    Attacker can cause unbounded memory consumption.

    The Pion DTLS client and server buffer handshake data with no
    upper limit, permitting an attacker to cause unbounded memory
    consumption by sending an unterminated handshake.
published: 2022-07-01T20:07:25Z
cves:
  - CVE-2022-29189
ghsas:
  - GHSA-cx94-mrg9-rq4j
references:
  - fix: https://github.com/pion/dtls/commit/a6397ff7282bc56dc37a68ea9211702edb4de1de