CVE-2026-54909

Published: Jul 31, 2026Modified: Oct 23, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423

Source: security-advisories@github.com

https://github.com/pion/stun/pull/278

Source: security-advisories@github.com

https://github.com/pion/stun/releases/tag/v3.1.3

Source: security-advisories@github.com

https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc

Source: security-advisories@github.com

Timeline

No history available yet.