MEDIUM
GHSA-wg4g-wm44-ch5j
Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message
Quick fix
GHSA-wg4g-wm44-ch5j — github.com/pion/dtls/v3: upgrade to the fixed version with the command below.
go get github.com/pion/dtls/v3@v3.1.4Details
### Impact Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message.
### Patches Upgrade to v3.1.4 or later. This version includes this patch https://github.com/pion/dtls/pull/839 which fixes the issue.
### Workarounds No work around; please upgrade to v3.1.4 or a newer version.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/pion/dtls/v3
Introduced in:
0 Fixed in: 3.1.4 Fix
go get github.com/pion/dtls/v3@v3.1.4 References
- https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j [WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-54908 [ADVISORY]
- https://github.com/pion/dtls/pull/839 [WEB]
- https://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e [WEB]
- https://github.com/pion/dtls [PACKAGE]
- https://github.com/pion/dtls/releases/tag/v3.1.3 [WEB]