CVE-2026-54909: pion stun Improper Input Validation
CVSS: 5.3v3.1MediumAwaiting analysis
AliasesUBUNTU-CVE-2026-54909DEBIAN-CVE-2026-54909CGA-232c-gqxj-f29vCGA-299m-f3gm-9578CGA-3q5x-965w-4f2hCGA-3vvv-9w52-775fCGA-4546-cpjr-mgmrCGA-4m4q-w2xq-fmf9CGA-4mpc-rxqh-54vcCGA-53fj-qcpp-c2c5CGA-626r-cpqv-43mgCGA-653r-85vx-hcqpCGA-68r2-m48h-m6m8CGA-6967-w3vp-w7mxCGA-6w4v-h9f2-2f24CGA-74qj-rcgj-f26pCGA-76j3-46vj-jvcwCGA-775j-3r5w-9cgwCGA-7g4p-74q6-4cf4CGA-83vw-2p5c-5chgCGA-8833-f9px-xpvcCGA-8c7j-9mf2-f592CGA-8rrg-x6wv-p3xjCGA-8rrp-2vh4-g8g7CGA-c4g2-2f93-8gm2CGA-c5mm-263v-4chjCGA-c8w6-577g-8qw4CGA-crwc-7w8q-7rf9CGA-f5pr-cq6j-wqjwCGA-fp5r-whpc-rfpmCGA-fw8j-w5v6-j7pjCGA-g3cf-2gff-2gmjCGA-h335-rcrm-v2rmCGA-h74r-47r8-xfq8CGA-j6vq-52w9-w89jCGA-jpx6-cg8w-fxrrCGA-jqcr-rwj2-vhfxCGA-mcpv-cqp8-9mw7CGA-mp4g-f2hj-8f88CGA-p283-9cjc-8qxqCGA-p4wx-w7h5-gc8mCGA-ph93-vrh3-c244CGA-q8vq-5794-2qf7CGA-qh4q-mm7x-8r8gCGA-r233-77cq-g5wvCGA-rfqf-2w5x-8vxrCGA-rq5v-3j8f-7xwcCGA-w97c-58jm-8h8jCGA-wf6v-gjgc-6mqrGHSA-34rh-wp3j-6cxcGO-2026-6163CGA-23cc-m82g-3vc7CGA-3gch-w7fj-cxf4CGA-3h9h-58p5-2886CGA-3hv5-cj88-fjwrCGA-3mj8-v2hp-6hp4CGA-45w5-9r99-895hCGA-4vv3-8548-w2rqCGA-5jjc-h2vf-mfmcCGA-62c3-whv3-cf3rCGA-76g2-w83f-ggjcCGA-7762-gm3h-fjfmCGA-8567-g4pr-mr88CGA-8vpm-rg32-w99vCGA-8wmh-7gfq-rmjgCGA-982x-fm7m-xf5hCGA-9p7r-jjf4-xmg9CGA-9v8x-c5rh-jfvwCGA-c8rq-qpfq-q479CGA-ccg4-7x9x-95p4CGA-cp6v-gvfh-5jx9CGA-cx8x-q3xm-37m8CGA-f38v-3833-hx35CGA-f967-w485-vgx7CGA-fjhf-xv89-8vq6CGA-g75v-6w42-jx3pCGA-hgpv-38wp-jqwcCGA-hv5m-qcq8-v8x6CGA-hwx5-ppvq-4h5mCGA-j358-8rwq-c7cqCGA-jhp7-873h-38vhCGA-jq55-vhp8-84v4CGA-jr7q-mcc3-9rrcCGA-mvm5-6pvm-g78pCGA-mvrh-gprc-p83fCGA-pf74-rgcj-92p2CGA-pqwp-54fx-9f62CGA-q7c4-x2mj-5v2wCGA-qxfr-9w9c-rg28CGA-r6p3-fxp2-3pgrCGA-rgpj-599j-3549CGA-vr7c-pjmg-q2crCGA-vv84-79gc-j326CGA-w3g3-32q7-3673CGA-wff4-p2f4-xxx9CGA-wr58-hpvm-w8f8CGA-xp2q-g2wc-69fh
Published 31-07-2026Last modified 03-08-2026
Vulnerability summary
CVE-2026-54909 is a medium (CVSS 5.3) Improper Input Validation vulnerability in pion stun. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.9% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.64%
0%100%
Low · +0.27 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 31-07-2026PublishedVulnerability first disclosed.
- 03-08-2026Last modifiedVulnerability information updated.
Description
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 5.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · GoEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.27 pp
From 0.37% on 20-09-2026
20-09-202620-10-2026
EPSS score0.64%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard37 products
- ipfs-cluster< 1.1.6-r18 | < 1.1.6-r12
- ipfs-cluster-fips< 1.1.6-r10
- k3s< 1.36.2.1-r9
- k3s-1.31All versions (No fix recorded)
- k3s-1.32All versions (No fix recorded)
Wolfi20 products
- ipfs-cluster< 1.1.6-r18 | < 1.1.6-r12
- k3s< 1.36.2.1-r9
- k3s-1.32All versions (No fix recorded)
- k3s-1.33All versions (No fix recorded)
- k3s-1.34< 1.34.9.1-r9
Debian2 products
- golang-github-pion-stunAll versions (No fix recorded)
- golang-github-pion-stun-v3All versions (No fix recorded)
Github.com/pion/stun2 products
- v2≤ 2.0.0
- v3< 3.1.5
Ubuntu2 products
- golang-github-pion-stunAll versions (No fix recorded)
- golang-github-pion-stun-v3All versions (No fix recorded)
Github.com/pion1 product
- stun≤ 1.23.1
Pion1 product
- stun< 3.1.3
7 vendors · 65 products
References
12 links
- github.com/pion/stunPACKAGE