https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T02:13:42.463096+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343796 EUVD-2026-343796 2026-10-06T02:13:42.465907+00:00 EUVD-2026-343796 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54909 fkie_cve-2026-54909 2026-10-06T02:13:42.465938+00:00

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.

 https://cve.radiocsirt.org/vuln/ghsa-34rh-wp3j-6cxc GHSA-34rh-wp3j-6cxc — Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute 2026-10-06T02:13:42.465968+00:00

Affected: Go: github.com/pion/stun/v3, Go: github.com/pion/stun/v2, Go: github.com/pion/stun

### Impact Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

### Patches Upgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue.

### Workarounds No work around; please upgrade to v3.1.5 or a newer version.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54909 UBUNTU-CVE-2026-54909 2026-10-06T02:13:42.465998+00:00

Affected: Ubuntu:24.04:LTS: golang-github-pion-stun, Ubuntu:26.04:LTS: golang-github-pion-stun, Ubuntu:26.04:LTS: golang-github-pion-stun-v3

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.