{"id":"GO-2026-6165","revision":"1c1bcf2ae5624a8cb9cbc21aba566013","records":[{"revision":"1c1bcf2ae5624a8cb9cbc21aba566013","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6165","aliases":["CVE-2026-54908","GHSA-wg4g-wm44-ch5j"],"title":"Panic while parsing crafted ECDHE_PSK ServerKeyExchange in github.com/pion/dtls/v3","description":"In github.com/pion/dtls/v3 before 3.1.4, MessageServerKeyExchange.Unmarshal does not verify that data remains after parsing the PSK identity hint when handling ECDHE_PSK key exchange messages. A remote peer sending a crafted ServerKeyExchange message where the PSK hint consumes all remaining data triggers an index out of range runtime panic, causing a denial of service.","state":0,"publishedAt":"2026-08-18T16:38:10+00:00","modifiedAt":"2026-08-18T17:15:27.9227731+00:00","affected":[{"ecosystem":"Go","name":"github.com/pion/dtls/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j","https://github.com/pion/dtls/pull/839","https://github.com/pion/dtls/commit/49458d604a4f3ebce1bf9587a0f3e5f3f6b4a55e","https://github.com/pion/dtls/releases/tag/v3.1.4"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6165","license":"OSV · upstream source license applies","key":"osv:GO-2026-6165","identifiers":["GO-2026-6165","CVE-2026-54908","GHSA-wg4g-wm44-ch5j"]},"retained":false,"historicalAffected":[]}],"coverage":[]}