Description
Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can be exploited to trigger a panic with Pion based SFU via crafted RTP packets, This only affect users that use pion/interceptor. Users should upgrade to v0.1.39 or later, which validates that: `padLen > 0 && padLen <= payloadLength` and return error on overflow, avoiding panic. If upgrading is not possible, apply the patch from the pull request manually or drop packets whose P-bit is set but whose padLen is zero or larger than the remaining payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pion | interceptor | >= 0.1.36, < 0.1.39 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-pion-interceptor | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-pion-interceptor | No fix yet | — |
| Ubuntu 25.10 | golang-github-pion-interceptor | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-pion-interceptor | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250612T141001-1.1 | openSUSE-SU-2025:15225-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | k3s +2 | 1.33.1.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/pion/interceptor | >= 0.1.36, < 0.1.39 | 0.1.39 | GHSA-f26w-gh5m-qq77 |
Advisories 1
- openSUSE-SU-2025:15225-1 govulncheck-vulndb-0.0.20250612T141001-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026