GitHub Advisoryadvisory · Go
GHSA-wg4g-wm44-ch5j Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message
MEDIUM
Official page ↗
- Aliases
- CVE-2026-54908
- Ecosystem
- Go
- Packages
- github.com/pion/dtls/v3
- Severity
- Moderate
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
- Weaknesses
- CWE-125
- Reviewed
- 2026-07-31
Affected packages
• Go github.com/pion/dtls/v3: < 3.1.4 → fixed in 3.1.4
Description
Impact
Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message.
Patches
Upgrade to v3.1.4 or later. This version includes this patch https://github.com/pion/dtls/pull/839 which fixes the issue.
Workarounds
No work around; please upgrade to v3.1.4 or a newer version.
Related
Alias · CVE (1)
- CVE-2026-54908 Pion DTLS is a Go implementation of Datagram Transport Layer Security. vulnerability
Weakness · CWE (1)
- CWE-125 Out-of-bounds Read weakness
References
- https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j web
- https://nvd.nist.gov/vuln/detail/CVE-2026-54908 advisory
- https://github.com/pion/dtls/pull/839 web
- https://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e web
- https://github.com/pion/dtls package
- https://github.com/pion/dtls/releases/tag/v3.1.3 web