EUVD-2026-41133
GHSA-wg4g-wm44-ch5j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects that ECDHE_PSK cipher suite must be active (mapping CVSS 4.0 AT:P); no confidentiality or integrity impact confirmed by available data.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4.
AnalysisAI
Remote denial of service in pion/dtls (Go's DTLS implementation) versions prior to 3.1.4 allows an unauthenticated network attacker to crash any application built on this library by sending a crafted ECDHE_PSK ServerKeyExchange message during the DTLS handshake. The CWE-125 out-of-bounds read triggers a Go runtime panic, immediately terminating the host process. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch exists in version 3.1.4.
Technical ContextAI
Pion DTLS (CPE: cpe:2.3:a:pion:dtls:*:*:*:*:*:*:*:*) is an open-source Go library implementing DTLS (Datagram Transport Layer Security, RFC 6347), widely embedded in WebRTC stacks, IoT gateways, and UDP-based secure communication services. The flaw is rooted in CWE-125 (Out-of-Bounds Read) within the parser for the ECDHE_PSK (Elliptic Curve Diffie-Hellman Ephemeral with Pre-Shared Key) variant of the ServerKeyExchange handshake message. In Go, an out-of-bounds slice access does not produce silent memory corruption as it would in C/C++; instead, the runtime immediately raises a panic, which - unless explicitly recovered - terminates the goroutine and, in practice, the entire server process. The CVSS 4.0 Attack Target prerequisite (AT:P) reflects that the vulnerable code path is only reachable when the ECDHE_PSK cipher suite is being negotiated, not on every DTLS connection.
RemediationAI
Vendor-released patch: pion/dtls 3.1.4. Upgrade by updating the Go module dependency to v3.1.4 or later, as addressed in pull request #839 (https://github.com/pion/dtls/pull/839) and confirmed by the security advisory at https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j. If an immediate upgrade is not feasible, the most targeted compensating control is to explicitly exclude ECDHE_PSK cipher suites from the server's accepted cipher suite list via pion/dtls configuration options; this prevents the crafted ServerKeyExchange message from reaching the vulnerable parser entirely. Be aware that disabling PSK cipher suites will break compatibility with any DTLS clients that rely exclusively on PSK-based key exchange, such as some constrained IoT devices. There is no evidence of active exploitation, but the simplicity of triggering a Go panic over the network makes patching the preferred path.
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Rated high severity (CVSS 7.5), this vulnerabilit
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Rated high severity (CVSS 7.5), this vulnerabilit
Pion DTLS is a Go implementation of Datagram Transport Layer Security. [CVSS 5.9 MEDIUM]
Pion DTLS is a Go implementation of Datagram Transport Layer Security. Rated medium severity (CVSS 5.3), this vulnerabil
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today