CVE-2026-54909
Medium
Low
Medium
High
Critical
5.3
CVSS Score
Vulnerability Description
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
N
Scope
U
Confidentiality
N
Integrity
N
Availability
L
References & Resources
-
https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423security-advisories@github.com
-
https://github.com/pion/stun/pull/278security-advisories@github.com
-
https://github.com/pion/stun/releases/tag/v3.1.3security-advisories@github.com
-
https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxcsecurity-advisories@github.com
Severity Details
5.3
out of 10.0
Medium
Weakness Type (CWE)
CWE-20
Top 25 #14
Improper Input Validation
- Description
- The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- Exploit Likelihood
- High
- Typical Severity
- High
- Abstraction Level
- Class
Key Information
- Published Date
- July 31, 2026
