CVE catalog

CVE-2025-49140

golang-github-pion-interceptor: CVE-2025-49140

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
0.49% · Oct 25, 2026

Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can be exploited to trigger a panic with Pion based SFU via crafted RTP packets, This only affect users that use pion/interceptor. Users should upgrade to v0.1.39 or later, which validates that: `padLen > 0 && padLen <= payloadLength` and return error on overflow, avoiding panic. If upgrading is not possible, apply the patch from the pull request manually or drop packets whose P-bit is set but whose padLen is zero or larger than the remaining payload.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-github-pion-interceptorsid0.1.47-1not affected
Debiangolang-github-pion-interceptorforky0.1.47-1not affected
Debiangolang-github-pion-interceptortrixie0.1.12-1not affected
Debiangolang-github-pion-interceptorbookworm0.1.12-1not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-github-pion-interceptorsourcesidNot affectedunimportantNot reportedNot reported
Debiangolang-github-pion-interceptorsourceforkyNot affectedunimportantNot reportedNot reported
Debiangolang-github-pion-interceptorsourcetrixieNot affectedunimportantNot reportedNot reported
Debiangolang-github-pion-interceptorsourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [SUSE security advisories and VEX]