Security Advisory catalog GO-2026-6163 GO-2026-6163 Published
Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute Overview Affected History Connections
cve-program · CVE-2026-54909 Published stun Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "pion",
"product": "stun",
"versions": [
{
"version": "< 3.1.3",
"status": "affected"
}
]
}
nvd · CVE-2026-54909 Published No affected-package array is stated in this source revision. Check its state and earlier observations; this does not establish that every package is unaffected.
osv · GHSA-34rh-wp3j-6cxc Published github.com/pion/stun/v3 Go
SEMVER · introduced 0 → fixed 3.1.5
github.com/pion/stun/v2 Go
SEMVER · introduced 0 → last_affected 2.0.0
github.com/pion/stun Go
SEMVER · introduced 0 → last_affected 1.23.1
osv · GO-2026-6163 Published github.com/pion/stun/v3 Go
SEMVER · introduced 0 → fixed 3.1.5