GitHub Advisoryadvisory · Go

GHSA-34rh-wp3j-6cxc Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

MEDIUM Published 2026-07-31 Modified 2026-07-31 Official page ↗
Aliases
CVE-2026-54909
Ecosystem
Go
Packages
github.com/pion/stun/v3, github.com/pion/stun/v2, github.com/pion/stun
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-20
Reviewed
2026-07-31

Affected packages

• Go github.com/pion/stun/v3: < 3.1.5 → fixed in 3.1.5 • Go github.com/pion/stun/v2: <= 2.0.0 (no fix yet) • Go github.com/pion/stun: <= 1.23.1 (no fix yet)

Description

Impact Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute Patches Upgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue. Workarounds No work around; please upgrade to v3.1.5 or a newer version.

Related

Alias · CVE (1)

  • CVE-2026-54909 pion/stun is a Go implementation of STUN. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References