Executive brief
Pion STUN is a software library used by developers to implement network protocols that help devices communicate behind firewalls, commonly used in video conferencing and real-time communications. A flaw in how the library handles specifically crafted network messages can cause the application using it to crash unexpectedly. This could allow a remote attacker to disrupt services, leading to a denial of service for users.
Technical details
A vulnerability in the `XORMappedAddress.GetFromAs` function in `pion/stun` allows for a remote denial of service. The issue stems from the function attempting to read the address family from the first two bytes of an attribute value before verifying that the value slice contains sufficient data. When processing a malformed STUN or ICE Binding-response message containing a short or zero-length XOR-MAPPED-ADDRESS attribute, the Go runtime triggers a slice-bounds panic. This can be exploited by an unauthenticated remote attacker sending malformed packets to a service utilizing the library. The issue is resolved in version 3.1.3 by moving the length validation check before the initial read.
Affected products
- pion stun < 3.1.3
Timeline
- 2026-06-02: patched: Fix merged in PR #278 and released in v3.1.3
- 2026-07-31: disclosed: CVE published to NVD