{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.23.1"}],"component":"github.com/pion/stun","cve_ids":["CVE-2026-54909"],"ecosystem":"Go","epss":0.00644,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-34rh-wp3j-6cxc","id":"tcs_01M5KET76FF105A9EDTCB1J9V8","modified_at":"2026-09-10T03:50:51.344851444Z","published_at":"2026-07-31T22:03:42Z","references":["https://osv.dev/vulnerability/GHSA-34rh-wp3j-6cxc","https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc","https://github.com/pion/stun/pull/278","https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423","https://github.com/pion/stun","https://github.com/pion/stun/releases/tag/v3.1.3"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-34rh-wp3j-6cxc#Go/github.com/pion/stun","url":"https://osv.dev/vulnerability/GHSA-34rh-wp3j-6cxc"}],"summary":"Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute"}