# CVE-2026-54908: Pion DTLS denial of service via panic in ServerKeyExchange parsing

Source: https://junglewise.ai/threats/cve-2026-54908-pion-dtls-denial-of-service-via-panic-in-serverkeyexchange  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-54908 · Severity: medium · CVSS 4 · Published 2026-07-01

Pion DTLS, a library used for secure real-time communications like WebRTC, is vulnerable to a denial of service attack. An attacker can send a specially crafted network message that causes the application to crash (panic). This could lead to service outages for users relying on the affected communication software.

Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-54908 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54908 being exploited in the wild.

**How severe is CVE-2026-54908?** Medium severity, with a CVSS score of 4, published 1 July 2026.

**Which products and versions are affected?** github.com/pion/dtls/v3 (Go) <= 3.1.2, SEMVER:introduced=0,fixed=3.1.4; Pion Dtls < 3.1.4, <= 3.1.2.

**Is there a fix for CVE-2026-54908?** Yes. github.com/pion/dtls/v3 (Go): upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54908 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54908?** Check whether you run github.com/pion/dtls/v3 (Go) or Pion Dtls at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/pion/dtls/v3 (Go): upgrade to 3.1.4 or later

  ```sh
  go get github.com/pion/dtls/v3@v3.1.4
  ```


## Technical details

A vulnerability in Pion DTLS (specifically the Go implementation) allows a remote attacker to trigger a panic, leading to a denial of service. The issue is classified as an out-of-bounds read (CWE-125) that occurs during the parsing of a crafted ECDHE_PSK ServerKeyExchange message. An attacker can exploit this by sending a malformed handshake message over the network without requiring any prior authentication. The vulnerability is addressed in version 3.1.4, which includes a fix for the improper parsing logic.

## Affected products

- pion dtls <= 3.1.2

## Identifiers

- CVE-2026-54908
- GHSA-wg4g-wm44-ch5j
- GO-2026-6165

## Timeline

- 2026-06-09: disclosed
- 2026-07-01: advisory: NVD publication
- 2026-07-31: patched: GitHub Advisory published/reviewed

## References

- [https://api.github.com/users/Sean-Der](https://api.github.com/users/Sean-Der)
- [https://github.com/Sean-Der](https://github.com/Sean-Der)
- [https://api.github.com/users/Sean-Der/gists%7B/gist_id%7D](https://api.github.com/users/Sean-Der/gists%7B/gist_id%7D)
- [https://api.github.com/users/Sean-Der/repos](https://api.github.com/users/Sean-Der/repos)
- [https://avatars.githubusercontent.com/u/1302304?v=4](https://avatars.githubusercontent.com/u/1302304?v=4)
- [https://api.github.com/users/Sean-Der/events%7B/privacy%7D](https://api.github.com/users/Sean-Der/events%7B/privacy%7D)

## Related threats

- [GO-2026-4479 - Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls](https://junglewise.ai/threats/cve-2026-26014-pion-dtls-s-usage-of-random-nonce-generation-with-aes-gcm-ciphers)