—

GO-2026-6165

Panic while parsing crafted ECDHE_PSK ServerKeyExchange in github.com/pion/dtls/v3

Quick fix

GO-2026-6165 — github.com/pion/dtls/v3: upgrade to the fixed version with the command below.

go get github.com/pion/dtls/v3@v3.1.4

Details

In github.com/pion/dtls/v3 before 3.1.4, MessageServerKeyExchange.Unmarshal does not verify that data remains after parsing the PSK identity hint when handling ECDHE_PSK key exchange messages. A remote peer sending a crafted ServerKeyExchange message where the PSK hint consumes all remaining data triggers an index out of range runtime panic, causing a denial of service.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/pion/dtls/v3

Introduced in: 0 Fixed in: 3.1.4

Fix go get github.com/pion/dtls/v3@v3.1.4

References

https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j [ADVISORY]
https://github.com/pion/dtls/pull/839 [FIX]
https://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e [FIX]
https://github.com/pion/dtls/releases/tag/v3.1.4 [WEB]