Is there a public PoC exploit available for CVE-2026-54908?

Yes, a public proof-of-concept exploit is available for CVE-2026-54908. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-54908?

Yes, a patch is available for CVE-2026-54908. Update the affected software to the latest version immediately.

Pion DTLS CVE-2026-54908

Q: What is the CVSS score of CVE-2026-54908?

CVE-2026-54908 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41133 MEDIUM

Out-of-bounds Read (CWE-125)

2026-07-01 GitHub_M

GHSA-wg4g-wm44-ch5j

Buffer Overflow Denial Of Service Information Disclosure Dtls Pion

6.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.7 LOW

AC:H reflects that ECDHE_PSK cipher suite must be active (mapping CVSS 4.0 AT:P); no confidentiality or integrity impact confirmed by available data.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 21:02 EUVD

Analysis Generated

Jul 01, 2026 - 20:20 vuln.today

CVE Published

Jul 01, 2026 - 19:34 cve.org

MEDIUM 6.3

DescriptionCVE.org

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4.

AnalysisAI

Remote denial of service in pion/dtls (Go's DTLS implementation) versions prior to 3.1.4 allows an unauthenticated network attacker to crash any application built on this library by sending a crafted ECDHE_PSK ServerKeyExchange message during the DTLS handshake. The CWE-125 out-of-bounds read triggers a Go runtime panic, immediately terminating the host process. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch exists in version 3.1.4.

Technical ContextAI

Pion DTLS (CPE: cpe:2.3:a:pion:dtls:*:*:*:*:*:*:*:*) is an open-source Go library implementing DTLS (Datagram Transport Layer Security, RFC 6347), widely embedded in WebRTC stacks, IoT gateways, and UDP-based secure communication services. The flaw is rooted in CWE-125 (Out-of-Bounds Read) within the parser for the ECDHE_PSK (Elliptic Curve Diffie-Hellman Ephemeral with Pre-Shared Key) variant of the ServerKeyExchange handshake message. In Go, an out-of-bounds slice access does not produce silent memory corruption as it would in C/C++; instead, the runtime immediately raises a panic, which - unless explicitly recovered - terminates the goroutine and, in practice, the entire server process. The CVSS 4.0 Attack Target prerequisite (AT:P) reflects that the vulnerable code path is only reachable when the ECDHE_PSK cipher suite is being negotiated, not on every DTLS connection.

RemediationAI

Vendor-released patch: pion/dtls 3.1.4. Upgrade by updating the Go module dependency to v3.1.4 or later, as addressed in pull request #839 (https://github.com/pion/dtls/pull/839) and confirmed by the security advisory at https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j. If an immediate upgrade is not feasible, the most targeted compensating control is to explicitly exclude ECDHE_PSK cipher suites from the server's accepted cipher suite list via pion/dtls configuration options; this prevents the crafted ServerKeyExchange message from reaching the vulnerable parser entirely. Be aware that disabling PSK cipher suites will break compatibility with any DTLS clients that rely exclusively on PSK-based key exchange, such as some constrained IoT devices. There is no evidence of active exploitation, but the simplicity of triggering a Go panic over the network makes patching the preferred path.