GHSA-wg4g-wm44-ch5j

Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-54908

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/pion/dtls/v3	< 3.1.4	3.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. ### Patches Upgrade to v3.1.4 or later. This version includes this patch https://github.com/pion/dtls/pull/839 which fixes the issue. ### Workarounds No work around; please upgrade to v3.1.4 or a newer version.

References

External links from the advisory. They lead to third-party sites.

https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j web
https://nvd.nist.gov/vuln/detail/CVE-2026-54908 advisory
https://github.com/pion/dtls/pull/839 web
https://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e web
https://github.com/pion/dtls package
https://github.com/pion/dtls/releases/tag/v3.1.3 web