CVE-2026-54909: Pion Stun

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.

Affected products

• Pion Stun: before 3.1.3 (fixed in 3.1.3)

Published 2026-07-31. Last modified 2026-09-10.