CVE-2025-49140

Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can be exploited to trigger a panic with Pion based SFU via crafted RTP packets, This only affect users that use pion/interceptor. Users should upgrade to v0.1.39 or later, which validates that: `padLen > 0 && padLen <= payloadLength` and return error on overflow, avoiding panic. If upgrading is not possible, apply the patch from the pull request manually or drop packets whose P-bit is set but whose padLen is zero or larger than the remaining payload.

• CWE-770

• https://github.com/pion/interceptor/commit/fa5b35ea867389cec33a9c82fffbd459ca8958e5
• https://github.com/pion/interceptor/pull/338
• https://github.com/pion/interceptor/security/advisories/GHSA-f26w-gh5m-qq77
• https://github.com/pion/webrtc/issues/3148

Published

Jun 9, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49135CVAT is an open source interactive video and image annotatio…6.5
• CVE-2025-49136listmonk is a standalone, self-hosted, newsletter and mailin…6.5
• CVE-2025-49137HAX CMS PHP allows users to manage their microsite universe …6.1
• CVE-2025-49138HAX CMS PHP allows users to manage their microsite universe …6.5
• CVE-2025-49139HAX CMS PHP allows users to manage their microsite universe …6.5
• CVE-2025-4914A vulnerability was found in PHPGurukul Auto Taxi Stand Mana…9.8
• CVE-2025-49141HAX CMS PHP allows users to manage their microsite universe …8.8
• CVE-2025-49142Nautobot is a Network Source of Truth and Network Automation…7.1
• CVE-2025-49143Nautobot is a Network Source of Truth and Network Automation…5.9
• CVE-2025-49144Notepad++ is a free and open-source source code editor. In v…7.3
• CVE-2025-49145Combodo iTop is a web based IT service management tool. In v…6.5
• CVE-2025-49146pgjdbc is an open source postgresql JDBC Driver. From 42.7.4…5.9