CVE-2026-54909: pion/stun Go Library DoS Vulnerability

CVE-2026-54909 Overview

CVE-2026-54909 is a denial-of-service vulnerability in pion/stun, a Go implementation of the Session Traversal Utilities for NAT (STUN) protocol. Versions prior to 3.1.3 contain an input validation flaw [CWE-20] in the XORMappedAddress.GetFromAs function. A malformed short XOR-MAPPED-ADDRESS attribute triggers a runtime panic during STUN or Interactive Connectivity Establishment (ICE) Binding-response parsing. Remote attackers can send crafted packets to crash services that rely on the library. The maintainers fixed the issue in pion/stun version 3.1.3.

Critical Impact
Unauthenticated remote attackers can send a single malformed STUN or ICE Binding-response packet to trigger a runtime panic, causing denial of service in applications built on pion/stun prior to 3.1.3.

Affected Products

pion/stun versions prior to 3.1.3
Go applications using pion WebRTC/ICE stacks that depend on pion/stun
Services exposing STUN or ICE Binding-response parsing paths to untrusted input

Discovery Timeline

2026-07-31 - CVE-2026-54909 published to the National Vulnerability Database (NVD)
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-54909

Vulnerability Analysis

The defect lives in the XORMappedAddress.GetFromAs code path inside xoraddr.go. The function parses the XOR-MAPPED-ADDRESS attribute delivered in STUN and ICE Binding-response messages. When the attribute value is shorter than expected, the function reads the address family bytes without verifying the buffer length. The Go runtime raises an out-of-bounds slice panic, terminating the goroutine and, in most deployments, the entire process.

The root category is improper input validation [CWE-20]. A single malformed packet from the network is sufficient to reach the vulnerable branch, and no authentication or user interaction is required.

Root Cause

The pre-patch code decoded the address family with bin.Uint16(value[0:2]) immediately after the TLV header check. It did not confirm that value contained the additional bytes required for the port and address fields. Any attribute whose value length is four bytes or fewer causes the subsequent slice indexing to panic.

Attack Vector

An attacker sends a crafted STUN Binding-response, or an ICE Binding-response during WebRTC connectivity checks, containing a truncated XOR-MAPPED-ADDRESS attribute. Any pion-based STUN client, TURN server, or WebRTC endpoint that parses the response crashes. Because STUN traffic uses UDP, attackers can spoof source addresses and target ICE candidates during signaling.

// Security patch in xoraddr.go - Fix panic on short XOR-MAPPED-ADDRESS value
 	if err != nil {
 		return err
 	}
+	if len(value) <= 4 {
+		return io.ErrUnexpectedEOF
+	}
 	family := bin.Uint16(value[0:2])
 	if family != familyIPv6 && family != familyIPv4 {
 		return newDecodeErr("xor-mapped address", "family",

Source: pion/stun commit fa9f074. The patch adds an explicit length check that returns io.ErrUnexpectedEOF before the code touches value[0:2].

Detection Methods for CVE-2026-54909

Indicators of Compromise

Unexpected process termination or restart in Go services that embed pion/stun, pion/ice, or pion/webrtc.
Go runtime panic stack traces referencing xoraddr.go, XORMappedAddress, or GetFromAs in application logs.
Inbound UDP STUN traffic on port 3478 or ephemeral ICE ports containing XOR-MAPPED-ADDRESS attributes with value lengths of four bytes or fewer.

Detection Strategies

Inspect STUN attribute type 0x0020 (XOR-MAPPED-ADDRESS) at the network layer and flag messages whose attribute length field is below 8.
Correlate crash-loop events on WebRTC, TURN, or SFU services with preceding UDP STUN traffic from a single source.
Add Go panic patterns for runtime error: slice bounds out of range originating in pion/stun to log-analytics detections.

Monitoring Recommendations

Track process restart counts and goroutine panic metrics for services using pion libraries.
Baseline STUN and ICE Binding-response volumes so anomalous bursts trigger alerts.
Enable structured logging on media servers to capture the full panic backtrace for forensic review.

How to Mitigate CVE-2026-54909

Immediate Actions Required

Upgrade pion/stun to version 3.1.3 or later in every Go module that depends on it, then rebuild and redeploy affected services.
Run go list -m -versions github.com/pion/stun and go mod why github.com/pion/stun to identify transitive dependencies pulled in by pion WebRTC and ICE packages.
Restart long-running STUN, TURN, and WebRTC services after upgrading to clear cached vulnerable code paths.

Patch Information

The fix is included in pion/stun v3.1.3. Review the GitHub Security Advisory GHSA-34rh-wp3j-6cxc, the pull request #278, and the v3.1.3 release notes for full remediation details.

Workarounds

Restrict STUN and ICE traffic to trusted peers using firewall rules or allow-lists where feasible.
Wrap pion/stun parsing calls in a recover() guard as a temporary safeguard until the upgrade is deployed.
Deploy rate limiting on UDP port 3478 and ephemeral ICE ports to reduce the impact of repeated crash attempts.

bash

# Update pion/stun to the patched release in a Go module
go get github.com/pion/stun@v3.1.3
go mod tidy
go build ./...