Anthropic's OSS Scanner found six security bugs in Pion DTLS: which Go WebRTC apps are affected and what to upgrade to
Pion's maintainers say Anthropic's OSS Scanner reported 36 bugs in pion/dtls, six of them security advisories (two critical). Four affect WebRTC. Here is which versions are vulnerable, why pion/webrtc v4.2.24 and dtls v3.1.13 cover the WebRTC cases, when you need v3.1.14, and why dtls v2 users have no patch.
If you ship Go code that uses Pion for WebRTC or plain DTLS, check your go.mod today. On October 16, 2026 the pion/dtls project published six security advisories, two rated critical, and released fixes in v3.1.13 and v3.1.14.
Short version: WebRTC apps should be on pion/webrtc v4.2.24 or later, which pins pion/dtls/v3 v3.1.13. If you use pion/dtls directly with a SessionStore and client-certificate or PSK auth, go to v3.1.14. No patched v2 release is listed.
Where the bugs came from
Pion maintainer JoTurk wrote on Hacker News that the project enrolled pion/dtls in Anthropic’s OSS Scanner (enrolment PR #93, merged October 10). The next report listed 36 bugs. Six were security issues, and per the maintainer some had been in the code for more than four years. Every advisory credits “Anthropic’s OSS Scanner” with a tracking ID.
The OSS Scanner is opt-in and free for eligible projects. Per its README, it builds your project in an isolated VM, analyzes it without Internet access, and emails reports with reproducers and proposed patches. Those reports are model-generated and not reviewed by a human. The maintainer said they still checked each finding by hand, which took a full day.
The six advisories
| Advisory | Severity | Affects WebRTC? | Fixed in |
|---|---|---|---|
| Handshake signature scheme confusion allows peer impersonation | Critical (CVSS 9.1) | Yes | v3.1.13 |
| Client auth bypass via premature DTLS 1.2 session caching | Critical (CVSS 9.1) | No | v3.1.14 |
| Client auth bypass when client and server share a session store | High (CVSS 7.4) | No | v3.1.14 |
| Unbounded handshake cache, remote memory exhaustion | High | Yes | v3.1.13 |
| Oversized peer RSA keys cause CPU exhaustion | High | Yes | v3.1.13 |
| Repeated client certificate verification causes CPU exhaustion | Moderate | Yes, when acting as DTLS server | v3.1.13 |
The worst one for WebRTC is the signature confusion bug. The advisory says an attacker who can redirect the handshake and has the peer’s public certificate could impersonate that peer without its private key. Checking the SDP certificate fingerprint does not stop it, because the attacker presents the real certificate.
The two session bugs need a configured SessionStore plus RequireAnyClientCert, RequireAndVerifyClientCert or PSK checks. The advisories say both “doesn’t affect webrtc users.”
How to check and upgrade
See which DTLS version you actually build with:
go list -m github.com/pion/dtls/v3
go mod why -m github.com/pion/dtls/v2Then upgrade:
go get github.com/pion/webrtc/v4@v4.2.24
go get github.com/pion/dtls/v3@v3.1.14 # needed for the session-store fixes
go mod tidypion/webrtc v4.2.24 requires dtls v3.1.13, so it picks up the four WebRTC-relevant fixes. The v3.1.14 release adds the resumption fixes.
On dtls v2? Each advisory lists v2 as affected through 2.2.12 and lists no patched v2 version. The only fix path is moving to v3 (and pion/webrtc v4).
Why it matters
This is the useful side of AI security scanning: a small set of real bugs, with fixes merged within days. It fits a pattern we have tracked, from agents finding Redis zero-days to Claude tracing the NIST curve seeds. To run a scanner on your own repo, see our guide to Codex Security.
Sources: pion/dtls security advisories · pion/dtls v3.1.13 and v3.1.14 releases · pion/webrtc v4.2.24 · anthropics/oss-scanner · Maintainer post on Hacker News