{"id":"CVE-2026-54909","aliases":["GHSA-34rh-wp3j-6cxc","GO-2026-6163"],"title":"Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute","summary":"Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","vendor":"pion","product":"github.com/pion/stun/v3","ecosystem":"go","affected":["github.com/pion/stun/v3 < 3.1.5","github.com/pion/stun/v2 <= 2.0.0","github.com/pion/stun <= 1.23.1"],"patched":["github.com/pion/stun/v3 3.1.5"],"published":"2026-07-31","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:51.344851444Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-34rh-wp3j-6cxc","references":[{"url":"https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc"},{"url":"https://github.com/pion/stun/pull/278"},{"url":"https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423"},{"url":"https://github.com/pion/stun"},{"url":"https://github.com/pion/stun/releases/tag/v3.1.3"},{"url":"https://github.com/advisories/GHSA-34rh-wp3j-6cxc"}],"tags":["osv","go","nvd","ghsa"],"epss":0.00371,"epssPercentile":0.30877,"cwe":["CWE-20"],"ingestedAt":"2026-07-31T22:04:41.417Z","slug":"CVE-2026-54909","body":"## Overview\n\n### Impact\nRemote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute\n\n### Patches\nUpgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue.\n\n### Workarounds\nNo work around; please upgrade to v3.1.5 or a newer version.\n\n## Affected packages\n\n- `github.com/pion/stun/v3 < 3.1.5`\n- `github.com/pion/stun/v2 <= 2.0.0`\n- `github.com/pion/stun <= 1.23.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/pion/stun/v3 3.1.5`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}