Vulnerability · Published Jul 31, 2026 · Assigned by GitHub_M
CVE-2026-54909Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
Medium 5.3
In plain English
A medium-severity improper input validation in stun from pion. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.6%top 48.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-pion-stun | no fix listed | DEBIAN-CVE-2026-54909 |
| Debian:13 | golang-github-pion-stun | no fix listed | DEBIAN-CVE-2026-54909 |
| Debian:14 | golang-github-pion-stun | no fix listed | DEBIAN-CVE-2026-54909 |
| Debian:14 | golang-github-pion-stun-v3 | no fix listed | DEBIAN-CVE-2026-54909 |
| Go | github.com/pion/stun | no fix listed | GHSA-34rh-wp3j-6cxc |
| Go | github.com/pion/stun/v2 | no fix listed | GHSA-34rh-wp3j-6cxc |
| Go | github.com/pion/stun/v3 | 3.1.5 | GHSA-34rh-wp3j-6cxc |
| Go | github.com/pion/stun/v3 | 3.1.5 | GO-2026-6163 |
| Ubuntu:24.04:LTS | golang-github-pion-stun | no fix listed | UBUNTU-CVE-2026-54909 |
| Ubuntu:26.04:LTS | golang-github-pion-stun | no fix listed | UBUNTU-CVE-2026-54909 |
| Ubuntu:26.10 | golang-github-pion-stun | no fix listed | UBUNTU-CVE-2026-54909 |
| Ubuntu:26.04:LTS | golang-github-pion-stun-v3 | no fix listed | UBUNTU-CVE-2026-54909 |
| Ubuntu:26.10 | golang-github-pion-stun-v3 | no fix listed | UBUNTU-CVE-2026-54909 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc x_refsource_CONFIRM
- https://github.com/pion/stun/pull/278 x_refsource_MISC
- https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423 x_refsource_MISC
- https://github.com/pion/stun/releases/tag/v3.1.3 x_refsource_MISC