CVE-2026-54909

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Published Jul 31, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.

Analysis

Technical impact

A malformed XOR-MAPPED-ADDRESS attribute causes the pion/stun library to panic while parsing STUN or ICE Binding-responses, resulting in a crash of the STUN service. The flaw is an input validation weakness (CWE-20) that allows an attacker to interrupt availability of the service without compromising data or executing code.

Affected Systems

The vulnerability affects the pion:stun library released by Pion. All versions older than 3.1.3 are susceptible, as the patch that fixes the panic is included only from 3.1.3 onward.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk, while an EPSS score of less than 1% shows a low probability that exploitation is being targeted. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to reach the STUN endpoint over the network, typically UDP or TCP, and send a crafted packet containing a short XOR-MAPPED-ADDRESS attribute. Successful exploitation would terminate the STUN service, leading to denial of service for clients relying on STUN or ICE.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pion

stun

affected

Version	Status	Constraints
`< 3.1.3`	affected	—

No data.

Vendor Product Versions

Pion

Stun

Version	Status	Scheme	Platform
`[0,3.1.3)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the pion/stun dependency to version 3.1.3 or later in your Go project, ensuring that go.mod and go.sum pin the fixed release.
Validate all transitive dependencies so that no older version of pion/stun is inadvertently pulled in during module resolution.
Wrap STUN processing calls in a recovery handler or run the STUN service in a sandboxed process so that a panic does not bring down the entire application.

Generated by OpenCVE AI on August 2, 2026 at 03:51 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-34rh-wp3j-6cxc	Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.644% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423
https://github.com/pion/stun/pull/278
https://github.com/pion/stun/releases/tag/v3.1.3
https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc

History

Aug 3, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 2, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Pion Pion stun
Vendors & Products		Pion Pion stun

Jul 31, 2026 10:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
Title		Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
Weaknesses		CWE-20
References		https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423 https://github.com/pion/stun/pull/278 https://github.com/pion/stun/releases/tag/v3.1.3 https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`