CVE-2026-54909

Received Received - Intake

XOR-MAPPED-Address Parsing Panic in pion/stun

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-07-31

Generated

2026-08-01

AI Q&A

2026-08-01

EPSS Evaluated

N/A

NVD

CVE-2026-54909

Affected Vendors & Products

Vendor	Product	Version / Range
pion	stun	3.1.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service issue in pion/stun, a Go library for STUN protocol. It occurs when parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response messages. The function XORMappedAddress.GetFromAs can panic, causing the application to crash.

Detection Guidance

This vulnerability can be detected by checking the version of the pion/stun library in use. If your system uses version 3.1.3 or later, it is not vulnerable. Commands to check the version depend on how the library is integrated into your application. For Go projects, run go list github.com/pion/stun@version or check go.mod for the dependency version.

Impact Analysis

If exploited, this vulnerability could allow remote attackers to crash your application by sending specially crafted STUN or ICE Binding-response messages. This could disrupt services relying on pion/stun for network communication.

Compliance Impact

This vulnerability causes a denial of service by crashing the application due to parsing errors in malformed STUN or ICE Binding-response data. It does not directly impact data confidentiality or integrity but may disrupt service availability, which could indirectly affect compliance with standards requiring high availability such as HIPAA for healthcare systems.

Mitigation Strategies

Update the pion/stun library to version 3.1.3 or later to address the vulnerability. If using Go modules, run go get github.com/pion/[email protected]. For systems using this library, ensure all dependencies are updated to prevent potential denial of service from malformed STUN or ICE Binding-response packets.

Hi! I’m here to help you understand CVE-2026-54909. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70