CVE-2026-54908

Summary

Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message

Severity

medium

EPSS

0.5% (p45)

CWE

CWE-125

Also known as

GHSA-wg4g-wm44-ch5j

Published

2026-07-31

Updated

2026-07-31

Advisory details

Impact

Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message.

Patches

Upgrade to v3.1.4 or later. This version includes this patch https://github.com/pion/dtls/pull/839 which fixes the issue.

Workarounds

No work around; please upgrade to v3.1.4 or a newer version.

References

• https://github.com/advisories/GHSA-wg4g-wm44-ch5j
• https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j
• https://nvd.nist.gov/vuln/detail/CVE-2026-54908
• https://github.com/pion/dtls/pull/839
• https://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e
• https://github.com/pion/dtls/releases/tag/v3.1.3

Related advisories

• CVE-2026-26014 — medium · Go/github.com/pion/dtls/v3
• CVE-2026-96639 — critical · PyPI/Pillow
• GHSA-26w7-cxv4-gfx2 — critical · npm/astro
• CVE-2026-55211 — critical · PyPI/surfio
• CVE-2026-55209 — critical · PyPI/resdata
• CVE-2023-4966 — critical · Citrix NetScaler/Citrix NetScaler ADC and NetScaler Gateway
• CVE-2026-96644 — high · PyPI/Pillow
• CVE-2026-112896 — high · PyPI/Pillow

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity