StackRadar

CVE-2026-54909

Medium

Advisory

Published 31 Jul 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
83
of 17,781 indexed, latest versions
Container images
66
deployed by those charts
Fix available
1 of 3
affected packages

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Carried by container images the latest versions of 83 of 17,781 indexed charts deploy, on 66 images.

Affected packageAffected versionsFixed inImages
github.com/pion/stun/v3golangv3.0.0, v3.1.0, v3.1.1, v3.1.2+1 more3.1.538
github.com/pion/stungolangv0.3.5, v0.6.0, v0.6.1no fix listed32
github.com/pion/stun/v2golangv2.0.0no fix listed9
OSV records
GHSA-34rh-wp3j-6cxc
Also known as
GO-2026-6163

Charts affected

83 by stars
ChartLatestAffected imagesRadar Score
rancherrancher-stable2.15.11 of 2See more

rancher rancher-stable 2.15.1

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

1,456
rancherrancher-latest2.15.11 of 2See more

rancher rancher-latest 2.15.1

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

1,456
spegelspegelVerified publisher0.7.41 of 1See more

spegel spegel 0.7.4

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/spegel-org/spegeldigest-pinned26c60b05e08a
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

176
home-assistantalekcVerified publisher2.11.21 of 1See more

home-assistant alekc 2.11.2

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

2,133
home-assistantandrenarchyVerified publisher14.103.01 of 1See more

home-assistant andrenarchy 14.103.0

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.1612d76760b54
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

2,133
codercoderOfficialVerified publisher1.44.61 of 2See more

coder coder 1.44.6

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
coderenvs/coder-service:1.44.61deffc4670e6
github.com/pion/stun@v0.3.5
no fix listed

Open the chart page →

6,849
gethethereum-helm-chartsVerified publisher1.1.41 of 2See more

geth ethereum-helm-charts 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethereum/client-go:stableb8ab3451a117
github.com/pion/stun/v3@v3.1.2
3.1.5

Open the chart page →

616
local-ailocalai3.4.21 of 1See more

local-ai localai 3.4.2

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

3,997
bscdysnixVerified publisher0.6.591 of 4See more

bsc dysnix 0.6.59

1 of the 4 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/bnb-chain/bsc:1.6.2fd0e3ec7d960
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
no fix listed
no fix listed

Open the chart page →

2,012
element-callelement-callVerified publisher0.1.441 of 2See more

element-call element-call 0.1.44

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/element-hq/lk-jwt-service:0.6.0822f0c03a3bd
github.com/pion/stun/v3@v3.1.4
3.1.5

Open the chart page →

156
netbirdhelmforgeVerified publisher1.0.101 of 4See more

netbird helmforge 1.0.10

1 of the 4 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
netbirdio/netbird-server:0.78.13086534361a1
github.com/pion/stun/v3@v3.1.0
3.1.5

Open the chart page →

2,962
home-assistanthome-assistantVerified publisher0.5.101 of 3See more

home-assistant home-assistant 0.5.10

1 of the 3 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

2,331
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

4,634
mattermost-rtcdmattermostVerified publisher1.4.11 of 1See more

mattermost-rtcd mattermost 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
mattermost/rtcd:latesta27058aaa53a
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

589
stunnerstunner1.2.11 of 2See more

stunner stunner 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
l7mp/stunner-auth-server:1.2.10d2094060b72
github.com/pion/stun/v3@v3.1.4
3.1.5

Open the chart page →

263
livekit-serverbeeinventor1.0.01 of 2See more

livekit-server beeinventor 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
livekit/livekit-server:v1.0.08391fd1b834f
github.com/pion/stun@v0.3.5
no fix listed

Open the chart page →

2,602
aramid-indexerbiatec-repoVerified publisher3.9.01 of 5See more

aramid-indexer biatec-repo 3.9.0

1 of the 5 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
scholtz2/aramid-algo-follow-node:v4.3.0-stable1ec63eca86b6
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

13,357
aramid-participationbiatec-repoVerified publisher4.4.11 of 1See more

aramid-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-aramidmain-extended:4.4.1-stablef12ce1cfb72e
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

7,190
aramid-relaybiatec-repoVerified publisher4.4.11 of 1See more

aramid-relay biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
scholtz2/aramid-algo-node:v4.4.1-stable70263d8fab5b
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

5,059
voimain-participationbiatec-repoVerified publisher4.4.11 of 1See more

voimain-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-voimain-extended:4.4.1-stable64966de56d9f
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

7,190
celestia-nodecelestia-node0.1.71 of 1See more

celestia-node celestia-node 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.16.041177982c584
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

1,799
spectrechronicleVerified publisher0.3.81 of 1See more

spectre chronicle 0.3.8

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/spectre:0.68.34e872bc016e8
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5

Open the chart page →

1,515
validatorchronicleVerified publisher0.8.01 of 1See more

validator chronicle 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/ghost:0.78.5951d71162065
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.1.1
no fix listed
3.1.5

Open the chart page →

475
ipfs-clusterethereum-helm-chartsVerified publisher0.1.142 of 3See more

ipfs-cluster ethereum-helm-charts 0.1.14

2 of the 3 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ipfs/ipfs-cluster:latesta83266c524f1
github.com/pion/stun/v3@v3.1.1
3.1.5
ipfs/kubo:latest63f5502f7a01
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

4,614
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

2,133
netbirdkitstream-netbird0.7.01 of 3See more

netbird kitstream-netbird 0.7.0

1 of the 3 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
netbirdio/netbird-server:0.77.1e71f39cefcd9
github.com/pion/stun/v3@v3.1.0
3.1.5

Open the chart page →

1,291
mcpmcp-chartsVerified publisher0.0.231 of 7See more

mcp mcp-charts 0.0.23

1 of the 7 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/gla-rad/mc-mms-router:latest032e977d9adf
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5

Open the chart page →

6,929
home-assistantpree-helm-chartsVerified publisher1.80.01 of 1See more

home-assistant pree-helm-charts 1.80.0

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

2,133
gethstakewise2.5.81 of 3See more

geth stakewise 2.5.8

1 of the 3 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethereum/client-go:v1.15.101f36ca5922a5
github.com/pion/stun/v2@v2.0.0
no fix listed

Open the chart page →

1,142
graph-nodestakewise3.1.01 of 3See more

graph-node stakewise 3.1.0

1 of the 3 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ipfs/kubo:v0.24.0e3de33bd746b
github.com/pion/stun@v0.6.0
no fix listed

Open the chart page →

4,661
stunner-gateway-operatorstunner1.1.01 of 2See more

stunner-gateway-operator stunner 1.1.0

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
l7mp/stunner-auth-server:1.1.02f8114477ba6
github.com/pion/stun/v3@v3.0.0
3.1.5

Open the chart page →

1,292
tor-snowflake-proxytor-snowflake-proxyVerified publisher1.2.01 of 1See more

tor-snowflake-proxy tor-snowflake-proxy 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
thetorproject/snowflake-proxy:v2.11.01ddc5069d354
github.com/pion/stun/v3@v3.0.0
3.1.5

Open the chart page →

740
celestia-localastria9.0.01 of 2See more

celestia-local astria 9.0.0

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5

Open the chart page →

3,281
celestia-nodeastria0.7.11 of 1See more

celestia-node astria 0.7.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.27.5-mocha4768ea1c5fd2
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5

Open the chart page →

1,502
algorand-participationbiatec-repoVerified publisher4.4.11 of 1See more

algorand-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-mainnet-extended:4.4.1-stable5aaa5d4ab8b8
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

7,190
algorand-relaybiatec-repoVerified publisher4.4.11 of 1See more

algorand-relay biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
scholtz2/algorand-relay-mainnet:4.4.1-stablee9af7d8ff6bb
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

5,059
ranchercarbide-charts2.15.11 of 2See more

rancher carbide-charts 2.15.1

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

1,456
charon-relaycharonOfficialVerified publisher0.8.01 of 2See more

charon-relay charon 0.8.0

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
obolnetwork/charon:v1.10.0278c7e2897b6
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5

Open the chart page →

4,396
dv-podcharonOfficialVerified publisher0.19.12 of 5See more

dv-pod charon 0.19.1

2 of the 5 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
obolnetwork/charon:v1.10.0278c7e2897b6
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5
obolnetwork/charon-dkg-sidecar:maine263be0a7440
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5

Open the chart page →

7,405
netbird-reverse-proxychristianhuthVerified publisher0.1.01 of 1See more

netbird-reverse-proxy christianhuth 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
netbirdio/reverse-proxy:0.72.43104d5ca3a76
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.1.0
no fix listed
3.1.5

Open the chart page →

912
arbitrumchronicleVerified publisher0.3.41 of 1See more

arbitrum chronicle 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
offchainlabs/nitro-node:v3.7.6-c0fe95e9f779fa84b7b
github.com/pion/stun/v2@v2.0.0
no fix listed

Open the chart page →

6,998
basechronicleVerified publisher0.0.81 of 1See more

base chronicle 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/base-org/node:v0.11.11aba0ffe55ea
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

4,810
ethereumchronicleVerified publisher0.3.11 of 1See more

ethereum chronicle 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethereum/client-go:v1.16.532b878e4144a
github.com/pion/stun/v2@v2.0.0
no fix listed

Open the chart page →

1,350
ethereum-metrics-exporterchronicleVerified publisher0.1.41 of 1See more

ethereum-metrics-exporter chronicle 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
samcm/ethereum-metrics-exporter:0.29.291a2d9a015c1
github.com/pion/stun/v2@v2.0.0
no fix listed

Open the chart page →

684
spirechronicleVerified publisher0.3.61 of 1See more

spire chronicle 0.3.6

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/chronicleprotocol/spire:0.68.379df4fb20322
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5

Open the chart page →

1,515
cospacecospace0.0.341 of 3See more

cospace cospace 0.0.34

1 of the 3 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/twigex/cospace:lateste5ecfd607e42
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

2,253
csi-driver-ipfscsi-driver-ipfs0.2.01 of 6See more

csi-driver-ipfs csi-driver-ipfs 0.2.0

1 of the 6 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/ptrvsrg/csi-driver-ipfs:latest97d2d9ccd7a5
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

3,629
ipfs-clustercsi-driver-ipfs0.2.02 of 2See more

ipfs-cluster csi-driver-ipfs 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ipfs/ipfs-cluster:v1.1.6a83266c524f1
github.com/pion/stun/v3@v3.1.1
3.1.5
ipfs/kubo:v0.41.00661819c2e09
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

1,475
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

2,158
doraethereum-helm-chartsVerified publisher1.0.121 of 2See more

dora ethereum-helm-charts 1.0.12

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/dora:master2381ea793a12
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.1.2
no fix listed
3.1.5

Open the chart page →

2,991

Container images carrying it

66 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/chronicleprotocol/ghost:0.78.5951d71162065
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.1.1
no fix listed
3.1.5
1
ghcr.io/chronicleprotocol/spectre:0.68.34e872bc016e8
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5
1
ghcr.io/chronicleprotocol/spire:0.68.379df4fb20322
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5
1
ghcr.io/deepch/rtsptoweb:v2.2.0f9de3a1a5deb
github.com/pion/stun@v0.3.5
no fix listed
1
ghcr.io/element-hq/lk-jwt-service:0.6.0822f0c03a3bd
github.com/pion/stun/v3@v3.1.4
3.1.5
1
ghcr.io/gla-rad/mc-mms-router:latest032e977d9adf
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5
1
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
github.com/pion/stun/v3@v3.1.1
3.1.5
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
github.com/pion/stun/v3@v3.1.1
3.1.5
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
github.com/pion/stun/v3@v3.0.0
3.1.5
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
github.com/pion/stun/v3@v3.1.1
3.1.5
1
ghcr.io/ptrvsrg/csi-driver-ipfs:latest97d2d9ccd7a5
github.com/pion/stun/v3@v3.1.1
3.1.5
1
ghcr.io/spegel-org/spegel26c60b05e08a
github.com/pion/stun/v3@v3.1.1
3.1.5
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
github.com/pion/stun/v2@v2.0.0
no fix listed
1
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
github.com/pion/stun/v2@v2.0.0
no fix listed
1
ghcr.io/twigex/cospace:lateste5ecfd607e42
github.com/pion/stun@v0.6.1
no fix listed
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/pion/stun/v3@v3.1.1
3.1.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.