{"vulnerability": "CVE-2026-54908", "sightings": [{"uuid": "9436600a-0594-4d54-91b7-c6531fa9d38a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54908", "type": "seen", "source": "https://gist.github.com/alon710/1bc8c607afec88c321177b4e1f89ad03", "content": "# CVE-2026-54908: CVE-2026-54908: Remote Denial of Service via Out-of-Bounds Read in Pion DTLS Handshake Parsing\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54908\n\n## Summary\nCVE-2026-54908 is a Denial of Service (DoS) vulnerability in the Pion DTLS library, where a malformed ServerKeyExchange message triggers an uncaught out-of-bounds slice read panic during handshake unmarshaling, terminating the hosting application process.\n\n## TL;DR\nAn unauthenticated remote attacker can crash any Go application utilizing Pion DTLS prior to v3.1.4 by sending a crafted 2-byte ServerKeyExchange packet during the DTLS handshake using ECDHE_PSK.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125 (Out-of-bounds Read)\n- **Attack Vector**: Network\n- **CVSS Score**: 6.3 (Medium)\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- Pion DTLS library\n- **Pion DTLS**: < 3.1.4 (Fixed in: `3.1.4`)\n\n## Mitigation\n\n- Disable ECDHE_PSK cipher suites in the DTLS configuration if upgrading is delayed\n- Deploy container restarts and process monitors to quickly recover from runtime crashes\n- Apply network filtering to allow DTLS handshakes only from trusted source IP ranges where possible\n\n**Remediation Steps:**\n1. Open the Go module file (go.mod) in the affected repository\n2. Update the github.com/pion/dtls dependency definition to version v3.1.4\n3. Execute 'go mod tidy' to synchronize the dependency tree and verify the build succeeds\n4. Redeploy the updated application to staging and production environments\n\n## References\n\n- [NVD CVE-2026-54908](https://nvd.nist.gov/vuln/detail/CVE-2026-54908)\n- [GitHub Security Advisory GHSA-wg4g-wm44-ch5j](https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54908) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T03:32:01.381821Z"}, {"uuid": "4d2d4209-babf-46a4-9951-2cab8984d3a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54908", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpny4wfpty2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-54908 \u0432 Pion DTLS: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/58C017C8-23D7-42A5-9764-113B85E2C610", "creation_timestamp": "2026-07-02T11:58:14.035224Z"}, {"uuid": "56e9a43f-0b31-4f0e-9763-add538837983", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54908", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqizncgtv2m", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-54908 \u0432 Pion DTLS: \u0443\u0433\u0440\u043e\u0437\u044b \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/8EC0F792-7E55-4293-B839-CCC1B95D0F8F", "creation_timestamp": "2026-07-03T12:05:56.480744Z"}]}