CVE-2026-54909 PUBLISHED

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Assigner: GitHub_M
Reserved: 16.06.2026 Published: 31.07.2026 Updated: 31.07.2026

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	pion
Product	stun
Versions	Version < 3.1.3 is affected

References

https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc
https://github.com/pion/stun/pull/278
https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423
https://github.com/pion/stun/releases/tag/v3.1.3

Problem Types

CWE-20: Improper Input Validation CWE