{"id":"EUVD-2026-41133","enisaUuid":"75070850-2d58-361c-8594-4c2ca5e48ce6","description":"Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4.","datePublished":"Jul 1, 2026, 7:34:24 PM","dateUpdated":"Jul 2, 2026, 3:54:54 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j\nhttps://github.com/pion/dtls/pull/839\n","aliases":"CVE-2026-54908\nGHSA-wg4g-wm44-ch5j\n","assigner":"GitHub_M","epss":0.54,"enisaIdProduct":[{"id":"21f17f52-523f-3679-bd5f-953ca62771b4","product":{"name":"dtls","vendor":{"name":"pion"}},"product_version":"\u003c 3.1.4"}],"enisaIdVendor":[{"id":"af68f0d3-12ee-3463-93aa-955c2c93404d","vendor":{"name":"pion"}}],"enisaIdVulnerability":[{"id":"0ce7c7ab-f2ea-33ec-a281-821a77b02bea","vulnerability":{"id":"GHSA-wg4g-wm44-ch5j","description":"Pion DTLS vulnerable to denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message","datePublished":"Jul 31, 2026, 10:06:33 PM","dateUpdated":"Jul 31, 2026, 10:06:33 PM","baseScore":0.0,"references":"https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54908\nhttps://github.com/pion/dtls/pull/839\nhttps://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e\nhttps://github.com/pion/dtls\nhttps://github.com/pion/dtls/releases/tag/v3.1.3\n","enisa_id":"EUVD-2026-41133\n","aliases":"GHSA-wg4g-wm44-ch5j\nCVE-2026-54908\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"91eeb6d0-7fcc-30eb-9adc-146f0d895f23","vulnerability":{"id":"CVE-2026-54908","description":"Pion DTLS is a Go implementation of Datagram Transport Layer Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of Service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message. This issue has been fixed in version 3.1.4.","datePublished":"Jul 1, 2026, 7:34:24 PM","dateUpdated":"Jul 2, 2026, 3:54:54 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j\nhttps://github.com/pion/dtls/pull/839\n","enisa_id":"EUVD-2026-41133\n","assigner":"GitHub_M","epss":0.54,"dataProcessed":"Nov 5, 2026, 7:16:41 AM","vulnerabilityProduct":[{"id":"3cc779a0-98b5-3ed5-aded-47178aea2029","product":{"name":"dtls","vendor":{"name":"pion"}},"product_version":"\u003c 3.1.4"}],"vulnerabilityVendor":[{"id":"24e1a430-74b4-3278-b776-0bfc723db450","vendor":{"name":"pion"}}]}}],"enisaIdAdvisory":[{"id":"1658ec7c-d38f-3557-9bfa-d634cf0f36fd","advisory":{"id":"msrc_CVE-2026-54908","description":"Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message","datePublished":"Jul 9, 2026, 1:03:02 AM","dateUpdated":"Aug 13, 2026, 12:07:14 AM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-54908.json\n","aliases":"CVE-2026-54908\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"09af658a-d67d-3b9f-b7ba-3abc2cabbf39","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"0a7bdb71-656a-31fd-8d79-d4f7e889028b","product":{"name":"azl3 telegraf 0:1.31.0-28.azl3","vendor":{"name":"Microsoft"}}},{"id":"374ad987-3e15-3036-8580-e2a7c7387bf8","product":{"name":"telegraf","vendor":{"name":"Microsoft"}}},{"id":"be1d1dcb-11a3-322d-9c48-47da5c811733","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"fc4cc0f1-64e5-3c20-87e1-7b319a3ae7f4","product":{"name":"azl3 telegraf 0:1.31.0-23.azl3","vendor":{"name":"Microsoft"}}}]}}]}