CVE-2026-54908
Received Received - Intake

Panic in Pion DTLS via ECDHE_PSK ServerKeyExchange

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: GitHub, Inc.

Description
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-02
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-54908
EUVD
EUVD-2026-41133

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
pion dtls to 3.1.2 (inc)
pion dtls to 3.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54908 is a vulnerability in the Pion DTLS library, a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 contain a flaw where a crafted ECDHE_PSK ServerKeyExchange message can cause the library to panic or crash due to a missing bounds check during message parsing.

This panic occurs because the ServerKeyExchange message is not properly validated, allowing invalid inputs to trigger a crash in the DTLS implementation.

The issue was fixed in version 3.1.4 by adding proper validation to prevent such invalid messages from causing a panic.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Impact Analysis

This vulnerability can lead to a remote denial of service (DoS) attack against systems using vulnerable versions of the Pion DTLS library.

An attacker can send a specially crafted ECDHE_PSK ServerKeyExchange message that causes the DTLS implementation to panic and crash, potentially disrupting services or applications relying on this library.

Since the vulnerability allows remote triggering without authentication, it can be exploited over the network, making affected systems unavailable until they are restarted or recovered.

Detection Guidance

There is no specific information provided about detection methods or commands to identify this vulnerability on a network or system.

Mitigation Strategies

The only recommended mitigation step is to upgrade the pion/dtls library to version 3.1.4 or later, where the vulnerability has been fixed.

No workarounds are recommended; upgrading is the sole solution to prevent the remote denial of service caused by a crafted ECDHE_PSK ServerKeyExchange message.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54908. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart