What is the CVSS score of CVE-2026-54909?

CVE-2026-54909 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2026-54909?

Yes, a public proof-of-concept exploit is available for CVE-2026-54909. Prioritise patching immediately. EPSS: 0.4%.

Is there a patch available for CVE-2026-54909?

Yes, a patch is available for CVE-2026-54909. Update the affected software to the latest version immediately.

pion/stun CVE-2026-54909

EUVD-2026-51666 MEDIUM

Improper Input Validation (CWE-20)

2026-07-31 GitHub_M

GHSA-34rh-wp3j-6cxc

Denial Of Service Suse Stun Pion

5.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

vuln.today AI

7.5 HIGH

Network-reachable with no auth; single malformed packet causes unrecovered Go panic, terminating the process - complete availability loss, not partial.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch available

Jul 31, 2026 - 23:02 EUVD

Source Code Evidence Fetched

Jul 31, 2026 - 22:51 vuln.today

Analysis Generated

Jul 31, 2026 - 22:51 vuln.today

DescriptionCVE.org

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.

AnalysisAI

Panic-triggered remote denial of service in pion/stun (Go STUN library) versions through 3.1.4 (v3), 2.0.0 (v2), and 1.23.1 (v1) allows an unauthenticated network attacker to crash any application embedding this library by sending a single malformed STUN or ICE Binding-response packet containing a zero-length XOR-MAPPED-ADDRESS attribute. The root cause is a misplaced bounds check in XORMappedAddress.GetFromAs that attempts to index into the value slice before validating minimum length, causing an unrecovered Go runtime panic that terminates the process. No public exploit identified at time of analysis, though the patch PR and test case publicly detail the exact malformed packet structure.

Technical ContextAI

pion/stun (CPE: cpe:2.3:a:pion:stun:*:*:*:*:*:*:*:*) is a widely used Go implementation of RFC 5389 STUN, commonly embedded in WebRTC and ICE stacks including the broader pion ecosystem. The XOR-MAPPED-ADDRESS attribute (type 0x0020) carries the reflexive transport address in STUN Binding responses; parsing is handled by XORMappedAddress.GetFromAs in xoraddr.go. CWE-20 (Improper Input Validation) is the root cause: the original code attempted to read value[1] (the address family byte) before the len(value) <= 4 guard, so a zero-length attribute payload causes an index-out-of-bounds Go panic. The patch (PR #278, commit fa9f074) moves that bounds check to the top of the function, before any slice indexing. Because Go panics propagate up the call stack and terminate the goroutine (and the whole process if uncaught), this is a hard crash rather than a graceful error return.

RemediationAI

For projects using github.com/pion/stun/v3, upgrade to v3.1.5 or later as directed by the GHSA advisory (https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc); the GHSA explicitly states v3.1.5 contains the fix via PR #278. Note that the CVE description references v3.1.3 as the fix but the GHSA package metadata marks v3.1.4 as still vulnerable - treat v3.1.5 as the authoritative minimum safe version until the discrepancy is resolved with the maintainer. For projects using github.com/pion/stun/v2 or the original github.com/pion/stun module, no fix has been released; the only remediation is migration to the v3 module line. No workaround is available per the GHSA advisory. As a compensating control for teams unable to upgrade immediately, placing a network-layer filter or rate limiter in front of STUN endpoints to drop packets with malformed attribute lengths can reduce exposure, though this requires protocol-aware inspection. The patch commit is fa9f074a33a8059c76c960b1fbee39f308002423.