Description
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
Published: 2026-07-31
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A malformed XOR-MAPPED-ADDRESS attribute causes the pion/stun library to panic while parsing STUN or ICE Binding-responses, resulting in a crash of the STUN service. The flaw is an input validation weakness (CWE-20) that allows an attacker to interrupt availability of the service without compromising data or executing code.

Affected Systems

The vulnerability affects the pion:stun library released by Pion. All versions older than 3.1.3 are susceptible, as the patch that fixes the panic is included only from 3.1.3 onward.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk, while an EPSS score of less than 1% shows a low probability that exploitation is being targeted. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to reach the STUN endpoint over the network, typically UDP or TCP, and send a crafted packet containing a short XOR-MAPPED-ADDRESS attribute. Successful exploitation would terminate the STUN service, leading to denial of service for clients relying on STUN or ICE.

Generated by OpenCVE AI on August 2, 2026 at 03:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the pion/stun dependency to version 3.1.3 or later in your Go project, ensuring that go.mod and go.sum pin the fixed release.
  • Validate all transitive dependencies so that no older version of pion/stun is inadvertently pulled in during module resolution.
  • Wrap STUN processing calls in a recovery handler or run the STUN service in a sandboxed process so that a panic does not bring down the entire application.

Generated by OpenCVE AI on August 2, 2026 at 03:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-34rh-wp3j-6cxc Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
History

Mon, 03 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 02 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Pion
Pion stun
Vendors & Products Pion
Pion stun

Fri, 31 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Description pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
Title Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
Weaknesses CWE-20
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Pion Stun
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-03T17:30:22.558Z

Reserved: 2026-06-16T13:49:33.556Z

Link: CVE-2026-54909

cve-icon Vulnrichment

Updated: 2026-08-03T17:29:14.158Z

cve-icon NVD

Status : Received

Published: 2026-07-31T23:17:25.433

Modified: 2026-08-03T18:16:39.733

Link: CVE-2026-54909

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T20:32:09Z

Weaknesses
  • CWE-20

    Improper Input Validation