Hi,

The following vulnerability was published for golang-github-pion-dtls.v3.

CVE-2026-54908[0]:
| Pion DTLS is a Go implementation of Datagram Transport Layer
| Security. Versions prior to 3.1.4 are vulnerable to Remote Denial of
| Service via panic while parsing a crafted ECDHE_PSK
| ServerKeyExchange message. This issue has been fixed in version
| 3.1.4.

https://github.com/pion/dtls/security/advisories/GHSA-wg4g-wm44-ch5j
https://github.com/pion/dtls/pull/839


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-54908
https://www.cve.org/CVERecord?id=CVE-2026-54908

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
golang-github-pion-dtls-v3, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141307@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Nilesh Patra <nilesh@debian.org> (supplier of updated golang-github-pion-dtls-v3 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 01 Aug 2026 09:28:55 +0200
Source: golang-github-pion-dtls-v3
Architecture: source
Version: 3.1.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Nilesh Patra <nilesh@debian.org>
Closes: 1141307
Changes:
 golang-github-pion-dtls-v3 (3.1.5-1) unstable; urgency=medium
 .
   * Team Upload.
   * Move d/watch to v5
   * New upstream version 3.1.5 (CLoses: #1141307)
     Fixes: CVE-2026-54908
   * Bump debhelper compatibility level to 14
   * Drop myself from uploaders
   * Refresh patch
   * Drop d/gitlab-ci.yml, move to d/salsa-ci.yml with default salsa CI
Checksums-Sha1:
 e87e2ee2300ced4b5c89ee7e21c88dbf8f9ae903 1736 golang-github-pion-dtls-v3_3.1.5-1.dsc
 c8a3155a356a19f738a54257580018828b931fc5 240532 golang-github-pion-dtls-v3_3.1.5.orig.tar.gz
 109746631ddd190cd099f9c66e35ee497b998af5 3600 golang-github-pion-dtls-v3_3.1.5-1.debian.tar.xz
 86e62cc985dc5dd1eddad28b5f577bf85ab39005 6386 golang-github-pion-dtls-v3_3.1.5-1_amd64.buildinfo
Checksums-Sha256:
 6e9f8d6a58899f3313dc9c5a58236fe8621d0324a6a1d73ff3d335e52bbbdf6e 1736 golang-github-pion-dtls-v3_3.1.5-1.dsc
 1a18a0b18e9f23f0d11a222a5c4bb0010bfaec692fb432e63d84f8033be2b1a5 240532 golang-github-pion-dtls-v3_3.1.5.orig.tar.gz
 bddb39bde3bd0e8d527a921ac5101222a3b95a8841d1ed70cf9a6a7e6bfca036 3600 golang-github-pion-dtls-v3_3.1.5-1.debian.tar.xz
 9a680763b1e1697ef364238709814d22bc326cf42a932ec353ea29f4907a58dc 6386 golang-github-pion-dtls-v3_3.1.5-1_amd64.buildinfo
Files:
 322e003b1937ef8eafe5200387e08ea0 1736 golang optional golang-github-pion-dtls-v3_3.1.5-1.dsc
 37770f98a9588a7a2335e79e97eefa8a 240532 golang optional golang-github-pion-dtls-v3_3.1.5.orig.tar.gz
 41c125789f004a2c584774b2617107b5 3600 golang optional golang-github-pion-dtls-v3_3.1.5-1.debian.tar.xz
 4d07e63f9dc1fabaf6ff64afb9e780dd 6386 golang optional golang-github-pion-dtls-v3_3.1.5-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQSglbZu4JAkvuai8HIqJ5BL1yQ+2gUCam2iewAKCRAqJ5BL1yQ+
2l5yAQC8O52Z0Bw8TkpCc3sRNz2r7fGmhKDlKXancxbHb+3OkgEA8PKqd4h+7esC
ICH1jNyssxwJROK0F9O67STmNhbukQA=
=W2nv
-----END PGP SIGNATURE-----