Godot 3.x/4.x: remote crash via DTLS receive-callback heap buffer overflow
// AI summary
Godot 3.2.2 through 4.7.2 and current master has a remote denial-of-service heap buffer overflow via DTLS receive-callback, affecting versions with DTLS-over-ENet from 4.0 onward.
// from the source
Posted by Tomasz Kaye on Oct 27 A remote denial-of-service vulnerability in Godot s DTLS networking was publicly disclosed on 2026-10-27 [1]. Affected versions: Godot 3.2.2 through 4.7.2 and current master (source inspection per tag). Runtime-confirmed on the official 4.7-stable Windows release template. DTLS is opt-in; the DTLS-over-ENet configuration exists from 4.0 onward, the raw PacketPeerDTLS path from 3.2.2. Description: The DTLS receive callback...