Medium severity5.3NVD Advisory· Published Jul 31, 2026· Updated Sep 10, 2026
CVE-2026-54909
CVE-2026-54909
Description
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/pion/stun/v3Go | < 3.1.5 | 3.1.5 |
github.com/pion/stun/v2Go | <= 2.0.0 | — |
github.com/pion/stunGo | <= 1.23.1 | — |
Affected products
43- osv-coords42 versionspkg:apk/chainguard/ipfs-clusterpkg:apk/chainguard/ipfs-cluster-fipspkg:apk/chainguard/k3spkg:apk/chainguard/k3s-1.34pkg:apk/chainguard/k3s-1.35pkg:apk/chainguard/k3s-staticpkg:apk/chainguard/k3s-static-1.34pkg:apk/chainguard/k3s-static-1.35pkg:apk/chainguard/kubopkg:apk/chainguard/kubo-fipspkg:apk/chainguard/livekit-egresspkg:apk/chainguard/op-gethpkg:apk/chainguard/op-geth-abigenpkg:apk/chainguard/op-geth-clefpkg:apk/chainguard/op-geth-devp2ppkg:apk/chainguard/op-geth-evmpkg:apk/chainguard/rke2-runtime-1.33pkg:apk/chainguard/rke2-runtime-1.34pkg:apk/chainguard/rke2-runtime-1.35pkg:apk/chainguard/rke2-runtime-1.36pkg:apk/chainguard/rke2-runtime-fips-1.33pkg:apk/chainguard/rke2-runtime-fips-1.34pkg:apk/chainguard/rke2-runtime-fips-1.35pkg:apk/chainguard/rke2-runtime-fips-1.36pkg:apk/chainguard/spegelpkg:apk/chainguard/spegel-fipspkg:apk/chainguard/stunnerdpkg:apk/wolfi/ipfs-clusterpkg:apk/wolfi/k3spkg:apk/wolfi/k3s-1.34pkg:apk/wolfi/k3s-1.35pkg:apk/wolfi/k3s-staticpkg:apk/wolfi/k3s-static-1.34pkg:apk/wolfi/k3s-static-1.35pkg:apk/wolfi/kubopkg:apk/wolfi/op-gethpkg:apk/wolfi/op-geth-abigenpkg:apk/wolfi/op-geth-clefpkg:apk/wolfi/op-geth-devp2ppkg:apk/wolfi/op-geth-evmpkg:apk/wolfi/spegelpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 1.1.6-r12+ 41 more
- (no CPE)range: < 1.1.6-r12
- (no CPE)range: < 1.1.6-r10
- (no CPE)range: < 1.36.2.1-r9
- (no CPE)range: < 1.34.9.1-r9
- (no CPE)range: < 1.35.6.1-r8
- (no CPE)range: < 1.36.2.1-r9
- (no CPE)range: < 1.34.9.1-r9
- (no CPE)range: < 1.35.6.1-r8
- (no CPE)range: < 0.42.0-r8
- (no CPE)range: < 0.42.0-r8
- (no CPE)range: < 1.13.0-r6
- (no CPE)range: < 1.101702.3-r0
- (no CPE)range: < 1.101702.3-r0
- (no CPE)range: < 1.101702.3-r0
- (no CPE)range: < 1.101702.3-r0
- (no CPE)range: < 1.101702.3-r0
- (no CPE)range: < 1.33.13.2.1-r3
- (no CPE)range: < 1.34.9.2.1-r7
- (no CPE)range: < 1.35.6.2.1-r10
- (no CPE)range: < 1.36.2.2.1-r9
- (no CPE)range: < 1.33.13.2.1-r2
- (no CPE)range: < 1.34.9.2.1-r9
- (no CPE)range: < 1.35.6.2.1-r7
- (no CPE)range: < 1.36.1.2.2-r11
- (no CPE)range: < 0.7.4-r3
- (no CPE)range: < 0.7.4-r4
- (no CPE)range: < 1.2.1-r5
- (no CPE)range: < 1.1.6-r12
- (no CPE)range: < 1.36.2.1-r9
- (no CPE)range: < 1.34.9.1-r9
- (no CPE)range: < 1.35.6.1-r8
- (no CPE)range: < 1.36.2.1-r9
- (no CPE)range: < 1.34.9.1-r9
- (no CPE)range: < 1.35.6.1-r8
- (no CPE)range: < 0.42.0-r8
- (no CPE)range: < 1.101702.3-r0
- (no CPE)range: < 1.101702.3-r0
- (no CPE)range: < 1.101702.3-r0
- (no CPE)range: < 1.101702.3-r0
- (no CPE)range: < 1.101702.3-r0
- (no CPE)range: < 0.7.4-r3
- (no CPE)range: < 0.0.20260827T195228-160000.1.1
Patches
Vulnerability mechanics
References
5News mentions
0No linked articles in our index yet.