{"id":"GHSA-34rh-wp3j-6cxc","revision":"8f650b02c65d45ccbe0deaf4f081b8e1","records":[{"revision":"8f650b02c65d45ccbe0deaf4f081b8e1","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-34rh-wp3j-6cxc","aliases":["CVE-2026-54909","GO-2026-6163"],"title":"Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute","description":"### Impact\nRemote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute\n\n### Patches\nUpgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue.\n\n### Workarounds\nNo work around; please upgrade to v3.1.5 or a newer version.","state":0,"publishedAt":"2026-07-31T22:03:42+00:00","modifiedAt":"2026-09-10T03:50:51.3448514+00:00","affected":[{"ecosystem":"Go","name":"github.com/pion/stun/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/pion/stun/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"2.0.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/pion/stun","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.23.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc","https://github.com/pion/stun/pull/278","https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423","https://github.com/pion/stun","https://github.com/pion/stun/releases/tag/v3.1.3"],"sourceUrl":"https://github.com/advisories/GHSA-34rh-wp3j-6cxc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-34rh-wp3j-6cxc","identifiers":["GHSA-34rh-wp3j-6cxc","CVE-2026-54909","GO-2026-6163"]},"retained":false,"historicalAffected":[]}],"coverage":[]}