Out-of-bounds Read in Pion Dtls
CVE-2026-54908
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4.
Vulnerability class: Buffer Overflow
EPSS: 0.003 (24.4th percentile) — read the EPSS interpretation.
Affected products
- Pion Dtls — versions < 3.1.4
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)