Log in Start free

Vulnerability · Published Jul 1, 2026 · Assigned by GitHub_M

CVE-2026-54908Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

Medium 6.3

In plain English

A medium-severity out-of-bounds read in dtls from pion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.5%top 54.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14golang-github-pion-dtls-v3no fix listedDEBIAN-CVE-2026-54908
Debian:12golang-github-pion-dtls.v2no fix listedDEBIAN-CVE-2026-54908
Debian:13golang-github-pion-dtls.v2no fix listedDEBIAN-CVE-2026-54908
Debian:14golang-github-pion-dtls.v2no fix listedDEBIAN-CVE-2026-54908
Gogithub.com/pion/dtls/v33.1.4GHSA-wg4g-wm44-ch5j
Gogithub.com/pion/dtls/v33.1.4GO-2026-6165
Ubuntu:26.04:LTSgolang-github-pion-dtls-v3no fix listedUBUNTU-CVE-2026-54908
Ubuntu:26.10golang-github-pion-dtls-v3no fix listedUBUNTU-CVE-2026-54908
Ubuntu:24.04:LTSgolang-github-pion-dtls.v2no fix listedUBUNTU-CVE-2026-54908
Ubuntu:25.10golang-github-pion-dtls.v2no fix listedUBUNTU-CVE-2026-54908
Ubuntu:26.04:LTSgolang-github-pion-dtls.v2no fix listedUBUNTU-CVE-2026-54908
Ubuntu:26.10golang-github-pion-dtls.v2no fix listedUBUNTU-CVE-2026-54908

Affected products (as reported)

VendorProductVersions
pion dtls < 3.1.4

Weakness: CWE-125, CWE-248 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References