PT-2026-66874 · Pion/Stun · Pion/Stun

CVE-2026-54909 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions pion/stun versions prior to 3.1.3

Description A remote denial of service can occur during the parsing of STUN or ICE Binding-response paths. The issue arises when the XORMappedAddress.GetFromAs() function processes a malformed short XOR-MAPPED-ADDRESS attribute, leading to a panic.

Recommendations Update to version 3.1.3 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-54909

GHSA-34RH-WP3J-6CXC

Affected Products

Pion/Stun

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-54909 · Security Note
• https://osv.dev/vulnerability/GHSA-34rh-wp3j-6cxc · Vendor Advisory
• https://github.com/pion/stun/releases/tag/v3.1.3 · Note
• https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc · Note
• https://github.com/pion/stun/pull/278 · Note
• https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423 · Note
• https://github.com/pion/stun · Note