Vulnerability Report: GO-2026-6165
- CVE-2026-54908, GHSA-wg4g-wm44-ch5j
- Affects: github.com/pion/dtls/v3
- Published: Aug 18, 2026
In github.com/pion/dtls/v3 before 3.1.4, MessageServerKeyExchange.Unmarshal does not verify that data remains after parsing the PSK identity hint when handling ECDHE_PSK key exchange messages. A remote peer sending a crafted ServerKeyExchange message where the PSK hint consumes all remaining data triggers an index out of range runtime panic, causing a denial of service.
For detailed information about this vulnerability, visit https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j.
Affected Packages
-
PathGo VersionsSymbols
-
before v3.1.4
Aliases
References
- https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j
- https://github.com/pion/dtls/pull/839
- https://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e
- https://github.com/pion/dtls/releases/tag/v3.1.4
- https://vuln.go.dev/ID/GO-2026-6165.json
Credits
- Karolina Gorna
Feedback
See anything missing or incorrect?
Suggest an edit to this report.