https://vulnerability.circl.lu/sightings/feed 2026-09-08T09:16:20.579112+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/aa1b1707-f14f-4433-af6f-ee4405925370/export 2026-09-08T09:16:20.589012+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "aa1b1707-f14f-4433-af6f-ee4405925370", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-wg4g-wm44-ch5j", "type": "seen", "source": "https://gist.github.com/alon710/1bc8c607afec88c321177b4e1f89ad03", "content": "# CVE-2026-54908: CVE-2026-54908: Remote Denial of Service via Out-of-Bounds Read in Pion DTLS Handshake Parsing\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54908\n\n## Summary\nCVE-2026-54908 is a Denial of Service (DoS) vulnerability in the Pion DTLS library, where a malformed ServerKeyExchange message triggers an uncaught out-of-bounds slice read panic during handshake unmarshaling, terminating the hosting application process.\n\n## TL;DR\nAn unauthenticated remote attacker can crash any Go application utilizing Pion DTLS prior to v3.1.4 by sending a crafted 2-byte ServerKeyExchange packet during the DTLS handshake using ECDHE_PSK.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-125 (Out-of-bounds Read)\n- **Attack Vector**: Network\n- **CVSS Score**: 6.3 (Medium)\n- **Exploit Status**: PoC Available\n- **CISA KEV Status**: Not Listed\n- **Ransomware Use**: No\n\n## Affected Systems\n\n- Pion DTLS library\n- **Pion DTLS**: < 3.1.4 (Fixed in: `3.1.4`)\n\n## Mitigation\n\n- Disable ECDHE_PSK cipher suites in the DTLS configuration if upgrading is delayed\n- Deploy container restarts and process monitors to quickly recover from runtime crashes\n- Apply network filtering to allow DTLS handshakes only from trusted source IP ranges where possible\n\n**Remediation Steps:**\n1. Open the Go module file (go.mod) in the affected repository\n2. Update the github.com/pion/dtls dependency definition to version v3.1.4\n3. Execute 'go mod tidy' to synchronize the dependency tree and verify the build succeeds\n4. Redeploy the updated application to staging and production environments\n\n## References\n\n- [NVD CVE-2026-54908](https://nvd.nist.gov/vuln/detail/CVE-2026-54908)\n- [GitHub Security Advisory GHSA-wg4g-wm44-ch5j](https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54908) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T03:32:01.435834Z"} 2026-08-01T03:32:01.435834+00:00