Godot 3.2.2–4.7.2 remote crash via DTLS heap overflow
Original title: Godot 3.x/4.x: remote crash via DTLS receive-callback heap buffer overflow
DTLS is opt-in; the flaw was runtime-confirmed on the official 4.7-stable Windows release template, with no fix named.
Tomasz Kaye publicly disclosed a remote denial-of-service flaw in Godot's DTLS networking on October 27. Affected builds are Godot 3.2.2 through 4.7.2 and current master, based on source inspection per tag. The DTLS-over-ENet path exists from 4.0 onward and the raw PacketPeerDTLS path from 3.2.2. The report points to a heap buffer overflow in the DTLS receive callback.
Unconfirmed: The snippet does not name a CVE or a fixed release, and it does not say the overflow yields code execution.
- Disclosed on oss-security on October 27 by Tomasz Kaye.
- Range stated as 3.2.2 through 4.7.2 plus current master.
- Confirmed at runtime on the official 4.7-stable Windows template.
- DTLS networking is opt-in, not enabled by default.
Impact: Remote denial of service via a heap overflow
| Product | Affected |
|---|---|
| Godot | 3.2.2 through 4.7.2 and current master |
From the original article
Posted by Tomasz Kaye on Oct 27 A remote denial-of-service vulnerability in Godot's DTLS networking was publicly disclosed on 2026-10-27 [1]. Affected versions: Godot 3. 2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.