---
id: CVE-2026-54908
aliases:
  - GHSA-wg4g-wm44-ch5j
title: >-
  Pion DTLS vulnerable to denial of service via panic while parsing a crafted
  ECDHE_PSK ServerKeyExchange message
summary: >-
  Pion DTLS vulnerable to denial of service via panic while parsing a crafted
  ECDHE_PSK ServerKeyExchange message
severity: medium
cwe:
  - CWE-125
vendor: pion
product: github.com/pion/dtls/v3
ecosystem: go
affected:
  - github.com/pion/dtls/v3 <= 3.1.2
patched:
  - github.com/pion/dtls/v3 3.1.4
published: '2026-07-31'
updated: '2026-07-31'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-wg4g-wm44-ch5j'
references:
  - url: 'https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54908'
  - url: 'https://github.com/pion/dtls/pull/839'
  - url: >-
      https://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e
  - url: 'https://github.com/pion/dtls/releases/tag/v3.1.3'
  - url: 'https://github.com/advisories/GHSA-wg4g-wm44-ch5j'
tags:
  - ghsa
  - go
epss: 0.00542
epssPercentile: 0.43152
ingestedAt: '2026-07-31T23:04:59.992Z'
---

## Overview

### Impact
Remote denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message.

### Patches
Upgrade to v3.1.4 or later. This version includes this patch https://github.com/pion/dtls/pull/839 which fixes the issue.

### Workarounds
No work around; please upgrade to v3.1.4 or a newer version.

## Affected packages

- `github.com/pion/dtls/v3 <= 3.1.2`

## Remediation

Upgrade to a patched release:

- `github.com/pion/dtls/v3 3.1.4`