CVE-2026-54908 Details
Description
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4.
A remote denial-of-service vulnerability has been identified in Pion DTLS, a Go implementation of Datagram Transport Layer Security. This issue affects versions of Pion DTLS through 3.1.2. The vulnerability arises from a panic that occurs while parsing a crafted ECDHE_PSK ServerKeyExchange message, leading to a denial-of-service condition.
Users are advised to upgrade to Pion DTLS version 3.1.4 or later, as this version includes the necessary patch to address the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pion/dtls/pull/839 | [email protected] | |
| https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |