Version 3.0.2-2 of golang-github-pion-stun-v3 is marked for autoremoval from testing on Sat 17 Oct 2026. It depends (transitively) on golang-github-rogpeppe-go-internal, affected by #1146612. You should try to prevent the removal by fixing these RC bugs.
CVE-2026-54909:
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
CVE-2026-54909:
pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/golang-github-pion-stun-v3.png){kind=link}