Is CVE-2026-54909 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-54909?

CVE-2026-54909 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-54909

Description

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.