CVE-2025-49140 Pion Interceptor's improper RTP padding handling allows remote crash for SFU users (DoS)

What is CVE-2025-49140?

CVE-2025-49140 is a high-severity denial of service vulnerability in pion interceptor, published on 9 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can be exploited to trigger a panic with Pion based SFU via crafted RTP packets, This only affect users that use pion/interceptor. Users should upgrade to v0.1.39 or later, which validates that: `padLen > 0 && padLen <= payloadLength` and return error on overflow, avoiding panic. If upgrading is not possible, apply the patch from the pull request manually or drop packets whose P-bit is set but whose padLen is zero or larger than the remaining payload.

Weakness: CWE-770

Which versions are affected by CVE-2025-49140?

3 open source packages ship an affected version, including github.com/pion/interceptor.

How do I fix CVE-2025-49140?

Upgrade github.com/pion/interceptor to 0.1.39 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-49140 being exploited?

There is no known exploitation of CVE-2025-49140 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f26w-gh5m-qq77, GO-2025-3748, UBUNTU-CVE-2025-49140.