---
id: CVE-2026-54909
aliases:
  - GHSA-34rh-wp3j-6cxc
  - GO-2026-6163
title: >-
  Pion STUN vulnerable to remote denial of service via panic while parsing a
  malformed XOR-MAPPED-ADDRESS attribute
summary: >-
  Pion STUN vulnerable to remote denial of service via panic while parsing a
  malformed XOR-MAPPED-ADDRESS attribute
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
vendor: pion
product: github.com/pion/stun/v3
ecosystem: go
affected:
  - github.com/pion/stun/v3 < 3.1.5
  - github.com/pion/stun/v2 <= 2.0.0
  - github.com/pion/stun <= 1.23.1
patched:
  - github.com/pion/stun/v3 3.1.5
published: '2026-07-31'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:51.344851444Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-34rh-wp3j-6cxc'
references:
  - url: 'https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc'
  - url: 'https://github.com/pion/stun/pull/278'
  - url: >-
      https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423
  - url: 'https://github.com/pion/stun'
  - url: 'https://github.com/pion/stun/releases/tag/v3.1.3'
  - url: 'https://github.com/advisories/GHSA-34rh-wp3j-6cxc'
tags:
  - osv
  - go
  - nvd
  - ghsa
epss: 0.00371
epssPercentile: 0.3102
cwe:
  - CWE-20
ingestedAt: '2026-07-31T22:04:41.417Z'
---

## Overview

### Impact
Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

### Patches
Upgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue.

### Workarounds
No work around; please upgrade to v3.1.5 or a newer version.

## Affected packages

- `github.com/pion/stun/v3 < 3.1.5`
- `github.com/pion/stun/v2 <= 2.0.0`
- `github.com/pion/stun <= 1.23.1`

## Remediation

Upgrade to a patched release:

- `github.com/pion/stun/v3 3.1.5`