{"id":"TECH-202610-unpatched-godot-dtls-flaw-lets-one-unauthenticated-udp-datag","kind":"technique","aliases":[],"related":[],"title":"Unpatched Godot DTLS flaw lets one unauthenticated UDP datagram overflow the heap and crash Godot game servers or clients","description":null,"summary":"In Godot Engine, the DTLS receive callback (PacketPeerMbedDTLS::bio_recv, modules/mbedtls/packet_peer_mbed_dtls.cpp) ignores the buffer size mbedTLS gives it (16,765 bytes in 4.7) and copies the whole UDP datagram (up to 65,507 bytes). This happens on the first handshake message, before any certificate check or login. One datagram sent from a plain UDP socket, with no account and no Godot tooling, writes attacker-chosen bytes past the end of a heap buffer. The researcher (axeghost, author of the game Axe Ghost) confirmed this with AddressSanitizer and on official 4.7-stable Windows exports: a community-hosted server using UDPServer + DTLSServer died at the join in 20 of 21 runs, and a player joining a hostile server died as well. In 2 of 8 runs an indirect call read attacker-overwritten memory. Code execution and an info leak were not shown. The researcher scores it CVSS 9.8 (worst case) or 7.5 (demonstrated crash only). At risk: games that turn on Godot's optional DTLS encryption for UDP/ENet multiplayer. Plain UDP and Steam networking are not affected. Per the source, affected from 3.2.2 (June 2020) through 4.7.2 and master (4.8-beta) as of 2026-10-27. Reported privately to Godot on 2026-09-26 with no reply. Published early, on 2026-10-27. Unpatched, no CVE yet, no exploitation in the wild reported.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Godot Engine","fixed":[],"affected":">= 3.2.2, <= 4.7.2 (and 4.8-beta master)","ecosystem":"other"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"Find Godot 3.2.2+ or 4.x projects that use DTLS: DTLSServer, PacketPeerDTLS, or ENetConnection.dtls_server_setup/dtls_client_setup. If they only use plain UDP/ENet without DTLS or Steam networking, they are not affected. Attack signs: incoming UDP datagrams on the game port larger than about 16,777 bytes during a handshake, and server crashes reported as STATUS_HEAP_CORRUPTION or access violation in the Windows event log while the process exit code reads 0 (so exit-code monitors see a clean shutdown). Other indicators: unknown.","fix":"No fixed Godot release yet. Patch the engine yourself and rebuild export templates: in PacketPeerMbedDTLS::bio_recv, copy at most the capacity mbedTLS passes (the way the TCP path already does), or drop datagrams larger than that. Until then: drop oversized UDP datagrams (above about 16 KB) at the firewall or in front of DTLS game servers, watch the system event log for heap-corruption crashes instead of relying on exit codes, and let players join only servers you run or trust. Watch the Godot repository for a fix and upgrade when it ships.","status":"open","published_at":"2026-10-27T00:00:00+00:00","first_seen_at":"2026-10-28T19:57:38+00:00","triaged_at":"2026-10-28T19:57:38+00:00","updated_at":"2026-10-28T19:57:38+00:00","category":"runtime","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-09':241B '-10':233B,250B '-202610':21A '-26':242B '-27':234B,251B '16':56B '2':160B '20':145B '2020':223B '2026':232B,240B,249B '21':147B '3.2.2':221B '4.7':60B,128B '4.7.2':225B '4.8':228B '507':70B '65':69B '7.5':190B '765':57B '8':162B '9.8':186B 'account':95B 'addresssanit':124B 'affect':215B,219B 'attack':102B,169B 'attacker-chosen':101B 'attacker-overwritten':168B 'author':115B 'axe':119B 'axeghost':114B 'beta':229B 'bio':46B 'buffer':51B,111B 'byte':58B,71B,104B 'call':166B 'callback':44B 'case':188B 'certif':81B 'check':82B 'chosen':103B 'client':19A 'code':172B 'communiti':134B 'community-host':133B 'confirm':121B 'copi':62B 'crash':14A,192B 'cve':254B 'cvss':185B 'datag':31A 'datagram':9A,66B,86B 'demonstr':191B 'die':140B,156B 'dtls':3A,25A,42B,203B 'dtlsserver':139B 'earli':35B,247B 'early-warn':34B 'encrypt':204B 'end':107B 'engin':40B 'engine':33A 'execut':173B 'exploit':257B 'export':131B 'first':76B 'flaw':4A,26A 'game':16A,118B,196B 'ghost':120B 'give':54B 'godot':2A,15A,24A,32A,39B,98B,200B,238B 'handshak':77B 'happen':73B 'heap':12A,110B 'host':135B 'hostil':154B 'ignor':49B 'indirect':165B 'info':176B 'join':143B,152B 'june':222B 'leak':177B 'let':5A 'lets':27A 'login':84B 'master':227B 'mbedtl':53B 'memori':171B 'messag':78B 'modules/mbedtls/packet_peer_mbed_dtls.cpp':48B 'multiplay':207B 'network':212B 'offici':127B 'one':6A,28A,85B 'option':202B 'overflow':10A 'overwritten':170B 'packetpeermbeddtl':45B 'past':105B 'per':216B 'plain':90B,208B 'player':151B 'privat':236B 'publish':246B 'read':167B 'receiv':43B 'recv':47B 'repli':245B 'report':235B,261B 'research':113B,182B 'risk':195B 'run':148B,163B 'score':183B 'sent':87B 'server':17A,136B,155B 'shown':180B 'size':52B 'socket':92B 'sourc':218B 'stabl':129B 'steam':211B 'tech':20A 'techniqu':37B 'tool':99B 'turn':198B 'udp':8A,30A,65B,91B,209B 'udp/enet':206B 'udpserv':138B 'unauthent':7A 'unauthenticated':29A 'unpatch':1A,252B 'unpatched':23A 'unpatched-godot-dtls-flaw-lets-one-unauthenticated-udp-datag':22A 'use':137B 'warn':36B 'well':158B 'whole':64B 'wild':260B 'window':130B 'worst':187B 'write':100B 'yet':255B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202610-unpatched-godot-dtls-flaw-lets-one-unauthenticated-udp-datag","url":null,"severity":null,"published_at":"2026-10-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-28T19:57:38+00:00","fetched_at":"2026-10-28T19:57:38+00:00","note":null}],"documents":[{"id":12022,"url":"https://x.com/_r_netsec/status/2115527357901766786","title":"@_r_netsec: An attacker can crash a Godot game server using DTLS with an unauthenticated UDP","kind":"post","source":"x","text":"An attacker can crash a Godot game server using DTLS with an unauthenticated UDP datagram https://t.co/TMzv3Xrfx4\n\nlikes 1 reposts 0","published_at":"2026-10-28T19:33:21+00:00","relation":"describes","confidence":null,"note":null},{"id":12137,"url":"https://t.co/TMzv3Xrfx4","title":"An attacker can crash a Godot game server using DTLS with a single UDP datagram (axeghost)","kind":"blog","source":"analyst","text":"Godot PacketPeerMbedDTLS::bio_recv (modules/mbedtls/packet_peer_mbed_dtls.cpp:75) ignores mbedTLS buffer capacity (16,765 bytes in 4.7) and copies whole UDP datagram (up to 65,507 bytes) during first handshake message, before authentication: unauthenticated heap buffer overflow. Confirmed on official 4.7-stable Windows export: server (UDPServer+DTLSServer) killed in 20/21 runs by one 65,507-byte datagram; client joining hostile server dies too. Kill threshold on 4.7: 16,777-byte datagram. Server exit code reads zero while event log records STATUS_HEAP_CORRUPTION/access violation. Indirect call read attacker-overwritten memory in 2/8 runs; no RCE or info leak shown. Affected by source: 3.2.2 onward, 4.7-4.7.2, master 4.8-beta as of 2026-10-27. DTLS opt-in; plain UDP/Steam networking not affected. Reported to security@godotengine.org 2026-09-26, no reply, published early. Researcher CVSS 9.8 (worst case) / 7.5 (demonstrated). Suggested fix: honour capacity argument like TCP path.","published_at":"2026-10-27T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}