GHSA-34rh-wp3j-6cxcMediumCVSS 5.3

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Published
July 31, 2026
Last Modified
July 31, 2026

🔗 CVE IDs covered (1)

CVE-2026-54909 →

📋 Description

Impact

Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Patches

Upgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue.

Workarounds

No work around; please upgrade to v3.1.5 or a newer version.

🎯 Affected products3

  • go/github.com/pion/stun/v3:<= 3.1.4
  • go/github.com/pion/stun/v2:<= 2.0.0
  • go/github.com/pion/stun:<= 1.23.1

🔗 References (5)