fix(deps): update module github.com/pion/dtls/v3 to v3.1.0 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/pion/dtls/v3	v3.0.10 → v3.1.0

GitHub Vulnerability Alerts

CVE-2026-26014

Impact

Pion DTLS versions v1.0.0 through v3.0.10 use random nonce generation with AES GCM ciphers, which makes it easier for remote attackers to obtain the authentication key and spoof data by leveraging the reuse of a nonce in a session and a "forbidden attack".

Patches

Upgrade to v3.1.1 or later. This version includes PR #​796, which uses the 64-bit sequence number to populate the nonce_explicit part of the GCM nonce. This is according to best practice outlined in RFC 9325 section 7.2.1.

v3.0.11 is a backport patch supporting Go v1.21

Workarounds

There are no workarounds without upgrading to version v3.0.11, v3.1.1 or later.

References

Commit fixing the bug: pion/dtls@61762de
Commit fixing the bug (backport): 90e241c
Pull request: #​796

---

Release Notes

pion/dtls (github.com/pion/dtls/v3)

v3.1.0

Compare Source

Options patterns, Security fix and performance improvements.

Changelog

• 61762de Use sequence number for nonce in GCM ciphers (#​796)
• 46ee7c3 Refactor Common AEAD Code in Ciphersuite Package (#​789)
• 10bd10a Prefer server srtp protection profiles ordering
• 93c2677 Fix rare flaky test
• d46d2a7 Fix Bug in signature_algorithms_cert Handling (#​791)
• acad848 DTLS 1.3 signature_algorithms_cert Extension (#​788)
• 0a5b311 Introduce options patterns
• 9495bef DTLS 1.3 RSA-PSS Signature Scheme Support (#​778)
• f1c63e9 Refactor error types for 1.3 extensions (#​787)
• bed33fe Add PreSharedKey extensions for DTLS 1.3 (#​773)
• 01f7ba5 Update CI configs to v0.11.37
• 5b824b0 CCM Encrypt Speed + Memory Mgmt Improvements (#​784)
• 100a3aa GCM Speed + Memory Mgmt Improvements (#​783)
• 199a753 Add Ciphersuite Benchmark Tests (#​781)
• 6b2fbf1 Fix Race Condition in TestListenerCustomConnIDs (#​782)
• 8ea3afc Fix intermittent unit test failures (#​780)
• c6db81b Update README
• 44160f0 DTLS 1.3 CertificateRequest + Certificate Messages (#​774)
• 9121462 Add Cookie extension for DTLS 1.3 (#​770)

v3.0.11

Compare Source

Backport security fix for GHSA-9f3f-wv7r-qc8r (CVE-2026-26014)

This is the only release with the security fix for Go v1.21.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.