Nixpkgs security tracker

Untriaged

Permalink CVE-2026-54909

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): Low (L)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): Low (L)

created 4 days, 1 hour ago Activity log

Created suggestion 4 days, 1 hour ago

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.

References

https://github.com/pion/stun/security/advisories/GHSA-34rh-wp3j-6cxc x_refsource_CONFIRM
https://github.com/pion/stun/pull/278 x_refsource_MISC
https://github.com/pion/stun/commit/fa9f074a33a8059c76c960b1fbee39f308002423 x_refsource_MISC
https://github.com/pion/stun/releases/tag/v3.1.3 x_refsource_MISC

Affected products

stun

==< 3.1.3

Matching in nixpkgs

pkgs.stun

Stun server and test client

nixos-unstable 0.97
- nixpkgs-unstable 0.97
- nixos-unstable-small 0.97
nixos-26.05 0.97
- nixos-26.05-small 0.97
- nixpkgs-26.05-darwin 0.97

pkgs.stunnel

Universal tls/ssl wrapper

nixos-unstable 5.76
- nixpkgs-unstable 5.76
- nixos-unstable-small 5.79
nixos-26.05 5.76
- nixos-26.05-small 5.76
- nixpkgs-26.05-darwin 5.76

pkgs.stunner

Detect your NAT quickly and easily, and that's the bottom line

nixos-unstable 0.0.12
- nixpkgs-unstable 0.0.12
- nixos-unstable-small 0.0.12
nixos-26.05 0.0.12
- nixos-26.05-small 0.0.12
- nixpkgs-26.05-darwin 0.0.12

pkgs.stuntman

Open source STUN server and client

nixos-unstable 1.2.16
- nixpkgs-unstable 1.2.16
- nixos-unstable-small 1.2.16
nixos-26.05 1.2.16
- nixos-26.05-small 1.2.16
- nixpkgs-26.05-darwin 1.2.16

pkgs.wstunnel

Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI

nixos-unstable 10.5.5
- nixpkgs-unstable 10.6.1
- nixos-unstable-small 10.6.2
nixos-26.05 10.5.4
- nixos-26.05-small 10.5.4
- nixpkgs-26.05-darwin 10.5.4

pkgs.ghostunnel

TLS proxy with mutual authentication support for securing non-TLS backend applications

nixos-unstable 1.10.0
- nixpkgs-unstable 1.10.0
- nixos-unstable-small 1.10.0
nixos-26.05 1.8.4
- nixos-26.05-small 1.8.4
- nixpkgs-26.05-darwin 1.8.4

pkgs.stuntrally

3D racing game with Sci-Fi elements and own Track Editor

nixos-unstable 3.3
- nixpkgs-unstable 3.3
- nixos-unstable-small 3.3
nixos-26.05 3.3
- nixos-26.05-small 3.3
- nixpkgs-26.05-darwin 3.3

pkgs.stunner-webrtc

Test and exploit STUN, TURN and TURN over TCP servers

nixos-unstable 0.5.8
- nixpkgs-unstable 0.5.8
- nixos-unstable-small 0.5.8
nixos-26.05 0.5.8
- nixos-26.05-small 0.5.8
- nixpkgs-26.05-darwin 0.5.8

pkgs.ultimatestunts

Remake of the popular racing DOS-game Stunts

nixos-unstable 0.7.7.1
- nixpkgs-unstable 0.7.7.1
- nixos-unstable-small 0.7.7.1
nixos-26.05 0.7.7.1
- nixos-26.05-small 0.7.7.1
- nixpkgs-26.05-darwin 0.7.7.1