pion/dtls · Security
Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message
- GHSA ID
- GHSA-wg4g-wm44-ch5j
- CVE ID
- CVE-2026-54908
- Severity
- medium
- Published
- Updated
- CVSS v4
- 6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Description
Impact
Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message.
Patches
Upgrade to v3.1.4 or later. This version includes this patch https://github.com/pion/dtls/pull/839 which fixes the issue.
Workarounds
No work around; please upgrade to v3.1.4 or a newer version.
CWEs
- CWE-125 · Out-of-bounds Read
References
- https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-54908 ↗
- https://github.com/pion/dtls/pull/839 ↗
- https://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e ↗
- https://github.com/pion/dtls/releases/tag/v3.1.3 ↗
- https://github.com/advisories/GHSA-wg4g-wm44-ch5j ↗