CVE-2026-54909: CVE-2026-54909: Remote Denial of Service in Pion STUN via Malformed XOR-MAPPED-ADDRESS Attribute

#security #cve #cybersecurity

CVE-2026-54909: Remote Denial of Service in Pion STUN via Malformed XOR-MAPPED-ADDRESS Attribute

Vulnerability ID: CVE-2026-54909
CVSS Score: 5.3
Published: 2026-07-31

A remote denial of service vulnerability exists in the pion/stun package before version 3.1.3. A malformed STUN packet containing a short or empty XOR-MAPPED-ADDRESS attribute triggers a runtime slice-bounds panic during parsing, terminating the entire Go process.

TL;DR

Unauthenticated malformed STUN packets can trigger a runtime panic in Pion STUN before 3.1.3, causing a denial of service.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-20
Attack Vector: Network
CVSS v3.1 Score: 5.3
Impact: Denial of Service
Exploit Status: poc
CISA KEV Status: No

Affected Systems

Pion STUN (Go module github.com/pion/stun)
Pion TURN (transitive dependency)
Pion WebRTC (transitive dependency)
Applications acting as WebRTC signaling or media servers using the affected libraries
stun: < 3.1.3 (Fixed in: 3.1.3)

Code Analysis

Commit: fa9f074

Validate XOR-MAPPED-ADDRESS value length before parsing

Mitigation Strategies

Upgrade github.com/pion/stun to version 3.1.3 or later
Filter out malformed STUN packets at the network layer using an IDS/IPS or firewall rule
Audit downstream imports (such as pion/turn or pion/webrtc) to ensure they resolve to the fixed version of pion/stun

Remediation Steps:

Open the go.mod file of the affected project
Run 'go get github.com/pion/stun/v3@v3.1.3'
Run 'go mod tidy' to update downstream dependencies
Recompile and redeploy the application

References

Read the full report for CVE-2026-54909 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community