Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Published Jul 31, 2026·Updated Jul 31, 2026

NVD Description

### Impact Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute ### Patches Upgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue. ### Workarounds No work around; please upgrade to v3.1.5 or a newer version.

Affected Packages (3)

github.com/pion/stunGO

Fixed in = 1.23.1

github.com/pion/stun/v2GO

Fixed in = 2.0.0

github.com/pion/stun/v3GO

Fixed in = 3.1.4

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free