Medium severityNVD Advisory· Published Jul 1, 2026· Updated Jul 2, 2026
CVE-2026-54908
CVE-2026-54908
Description
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/pion/dtls/v3Go | < 3.1.4 | 3.1.4 |
Affected products
37- Range: <3.1.4
- osv-coords35 versionspkg:apk/chainguard/ipfs-clusterpkg:apk/chainguard/ipfs-cluster-fipspkg:apk/chainguard/k3spkg:apk/chainguard/k3s-1.34pkg:apk/chainguard/k3s-1.35pkg:apk/chainguard/k3s-staticpkg:apk/chainguard/k3s-static-1.34pkg:apk/chainguard/k3s-static-1.35pkg:apk/chainguard/kubopkg:apk/chainguard/kubo-fipspkg:apk/chainguard/livekit-egresspkg:apk/chainguard/rke2-runtime-1.33pkg:apk/chainguard/rke2-runtime-1.34pkg:apk/chainguard/rke2-runtime-1.35pkg:apk/chainguard/rke2-runtime-1.36pkg:apk/chainguard/rke2-runtime-fips-1.32pkg:apk/chainguard/rke2-runtime-fips-1.33pkg:apk/chainguard/rke2-runtime-fips-1.34pkg:apk/chainguard/rke2-runtime-fips-1.35pkg:apk/chainguard/rke2-runtime-fips-1.36pkg:apk/chainguard/spegelpkg:apk/chainguard/spegel-fipspkg:apk/chainguard/telegraf-1.37pkg:apk/chainguard/telegraf-1.38pkg:apk/wolfi/ipfs-clusterpkg:apk/wolfi/k3spkg:apk/wolfi/k3s-1.34pkg:apk/wolfi/k3s-1.35pkg:apk/wolfi/k3s-staticpkg:apk/wolfi/k3s-static-1.34pkg:apk/wolfi/k3s-static-1.35pkg:apk/wolfi/kubopkg:apk/wolfi/spegelpkg:apk/wolfi/telegraf-1.37pkg:apk/wolfi/telegraf-1.38
< 1.1.6-r12+ 34 more
- (no CPE)range: < 1.1.6-r12
- (no CPE)range: < 1.1.6-r10
- (no CPE)range: < 1.36.2.1-r9
- (no CPE)range: < 1.34.9.1-r9
- (no CPE)range: < 1.35.6.1-r8
- (no CPE)range: < 1.36.2.1-r9
- (no CPE)range: < 1.34.9.1-r9
- (no CPE)range: < 1.35.6.1-r8
- (no CPE)range: < 0.42.0-r8
- (no CPE)range: < 0.42.0-r8
- (no CPE)range: < 1.13.0-r6
- (no CPE)range: < 1.33.13.2.1-r3
- (no CPE)range: < 1.34.9.2.1-r7
- (no CPE)range: < 1.35.6.2.1-r9
- (no CPE)range: < 1.36.2.2.1-r9
- (no CPE)range: < 1.32.13.2.2-r5
- (no CPE)range: < 1.33.13.2.1-r2
- (no CPE)range: < 1.34.9.2.1-r9
- (no CPE)range: < 1.35.6.2.1-r7
- (no CPE)range: < 1.36.1.2.2-r11
- (no CPE)range: < 0.7.4-r3
- (no CPE)range: < 0.7.4-r4
- (no CPE)range: < 1.37.3-r22
- (no CPE)range: < 1.38.4-r18
- (no CPE)range: < 1.1.6-r12
- (no CPE)range: < 1.36.2.1-r9
- (no CPE)range: < 1.34.9.1-r9
- (no CPE)range: < 1.35.6.1-r8
- (no CPE)range: < 1.36.2.1-r9
- (no CPE)range: < 1.34.9.1-r9
- (no CPE)range: < 1.35.6.1-r8
- (no CPE)range: < 0.42.0-r8
- (no CPE)range: < 0.7.4-r3
- (no CPE)range: < 1.37.3-r22
- (no CPE)range: < 1.38.4-r18
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-wg4g-wm44-ch5jghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-54908ghsaADVISORY
- github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55eghsaWEB
- github.com/pion/dtls/pull/839nvdWEB
- github.com/pion/dtls/releases/tag/v3.1.3ghsaWEB
- github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5jnvdWEB
News mentions
0No linked articles in our index yet.