Is github.com/pion/stun/v3 affected by CVE-2026-54909?

Go github.com/pion/stun/v3 is affected in <= 3.1.4.

Is CVE-2026-54909 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.6%.

medium

CVE-2026-54909

Q: Is CVE-2026-54909 being exploited?

Not on the CISA KEV list. EPSS exploit probability is 0.6%.

Go · github.com/pion/stun/v3

Summary

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Severity: medium
CVSS: 5.3
EPSS: 0.6% (p51)
CWE: CWE-20
Also known as: GHSA-34rh-wp3j-6cxc#github.com/pion/stun/v3
Published: 2026-07-31
Updated: 2026-07-31

Advisory details

Impact

Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Patches

Upgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue.

Workarounds

No work around; please upgrade to v3.1.5 or a newer version.

References

Related advisories

CVE-2026-96620 — critical · PyPI/claude-agent-sdk
CVE-2026-107726 — critical · Maven/com.hazelcast:hazelcast
CVE-2026-55068 — critical · Go/github.com/free5gc/free5gc
CVE-2026-54133 — critical · Packagist/mtdowling/jmespath.php
GHSA-rjg6-39jm-rgg4 — critical · npm/@better-auth/scim
CVE-2026-53713 — critical · Go/github.com/envoyproxy/gateway
CVE-2026-53513 — critical · npm/@better-auth/sso
CVE-2026-48769 — critical · Go/github.com/lxc/incus/v7/cmd/incusd

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPT Claude Perplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.