GO-2026-6165
Panic while parsing crafted ECDHE_PSK ServerKeyExchange in github.com/pion/dtls/v3
At a glance
- Published
- Updated
- CVE
- CVE-2026-54908
- Aliases
- GHSA-wg4g-wm44-ch5j
Description
In github.com/pion/dtls/v3 before 3.1.4, MessageServerKeyExchange.Unmarshal does not verify that data remains after parsing the PSK identity hint when handling ECDHE_PSK key exchange messages. A remote peer sending a crafted ServerKeyExchange message where the PSK hint consumes all remaining data triggers an index out of range runtime panic, causing a denial of service.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/pion/dtls/v3 | introduced 0, fixed 3.1.4 |
References
- https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j ADVISORY
- https://github.com/pion/dtls/pull/839 FIX
- https://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e FIX
- https://github.com/pion/dtls/releases/tag/v3.1.4 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |