CVE-2026-54908: Pion DTLS denial of service via panic in ServerKeyExchange parsing

Executive brief

Pion DTLS, a library used for secure real-time communications like WebRTC, is vulnerable to a denial of service attack. An attacker can send a specially crafted network message that causes the application to crash (panic). This could lead to service outages for users relying on the affected communication software.

Technical details

A vulnerability in Pion DTLS (specifically the Go implementation) allows a remote attacker to trigger a panic, leading to a denial of service. The issue is classified as an out-of-bounds read (CWE-125) that occurs during the parsing of a crafted ECDHE_PSK ServerKeyExchange message. An attacker can exploit this by sending a malformed handshake message over the network without requiring any prior authentication. The vulnerability is addressed in version 3.1.4, which includes a fix for the improper parsing logic.

Affected products

• pion dtls <= 3.1.2

Timeline

• 2026-06-09: disclosed
• 2026-07-01: advisory: NVD publication
• 2026-07-31: patched: GitHub Advisory published/reviewed

References

• https://api.github.com/users/Sean-Der
• https://github.com/Sean-Der
• https://api.github.com/users/Sean-Der/gists%7B/gist_id%7D
• https://api.github.com/users/Sean-Der/repos
• https://avatars.githubusercontent.com/u/1302304?v=4
• https://api.github.com/users/Sean-Der/events%7B/privacy%7D