StackRadar

CVE-2026-54909

Medium

Advisory

Published 31 Jul 2026In the index since 6 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.004
31st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
83
of 17,781 indexed, latest versions
Container images
66
deployed by those charts
Fix available
1 of 3
affected packages

Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute

Carried by container images the latest versions of 83 of 17,781 indexed charts deploy, on 66 images.

Affected packageAffected versionsFixed inImages
github.com/pion/stun/v3golangv3.0.0, v3.1.0, v3.1.1, v3.1.2+1 more3.1.538
github.com/pion/stungolangv0.3.5, v0.6.0, v0.6.1no fix listed32
github.com/pion/stun/v2golangv2.0.0no fix listed9
OSV records
GHSA-34rh-wp3j-6cxc
Also known as
GO-2026-6163

Charts affected

83 by stars
ChartLatestAffected imagesRadar Score
ethereum-metrics-exporterethereum-helm-chartsVerified publisher0.2.11 of 1See more

ethereum-metrics-exporter ethereum-helm-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
samcm/ethereum-metrics-exporter:latest91a2d9a015c1
github.com/pion/stun/v2@v2.0.0
no fix listed

Open the chart page →

684
forkyethereum-helm-chartsVerified publisher0.2.01 of 1See more

forky ethereum-helm-charts 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/forky:debian-latestc937f4ba737c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5

Open the chart page →

1,703
xatuethereum-helm-chartsVerified publisher0.0.11 of 1See more

xatu ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.0.0
no fix listed
no fix listed
3.1.5

Open the chart page →

579
xatu-cannonethereum-helm-chartsVerified publisher0.2.21 of 1See more

xatu-cannon ethereum-helm-charts 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.0.0
no fix listed
no fix listed
3.1.5

Open the chart page →

579
xatu-cl-mimicryethereum-helm-chartsVerified publisher0.0.21 of 1See more

xatu-cl-mimicry ethereum-helm-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.0.0
no fix listed
no fix listed
3.1.5

Open the chart page →

579
xatu-consumoorethereum-helm-chartsVerified publisher0.0.11 of 1See more

xatu-consumoor ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.0.0
no fix listed
no fix listed
3.1.5

Open the chart page →

579
xatu-discoveryethereum-helm-chartsVerified publisher0.0.61 of 1See more

xatu-discovery ethereum-helm-charts 0.0.6

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.0.0
no fix listed
no fix listed
3.1.5

Open the chart page →

579
xatu-mimicryethereum-helm-chartsVerified publisher0.0.71 of 1See more

xatu-mimicry ethereum-helm-charts 0.0.7

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.0.0
no fix listed
no fix listed
3.1.5

Open the chart page →

579
xatu-relay-monitorethereum-helm-chartsVerified publisher0.0.11 of 1See more

xatu-relay-monitor ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.0.0
no fix listed
no fix listed
3.1.5

Open the chart page →

579
xatu-sageethereum-helm-chartsVerified publisher0.0.11 of 1See more

xatu-sage ethereum-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.0.0
no fix listed
no fix listed
3.1.5

Open the chart page →

579
xatu-sentryethereum-helm-chartsVerified publisher0.0.81 of 1See more

xatu-sentry ethereum-helm-charts 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.0.0
no fix listed
no fix listed
3.1.5

Open the chart page →

579
xatu-serverethereum-helm-chartsVerified publisher0.0.141 of 1See more

xatu-server ethereum-helm-charts 0.0.14

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethpandaops/xatu:latest74d4cf2c436c
github.com/pion/stun@v0.6.1
github.com/pion/stun/v2@v2.0.0
github.com/pion/stun/v3@v3.0.0
no fix listed
no fix listed
3.1.5

Open the chart page →

579
beekeeperethersphereVerified publisher0.4.141 of 1See more

beekeeper ethersphere 0.4.14

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethersphere/beekeeper:lateste4cda693ed63
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

1,604
rtsp-to-webgeek-cookbookVerified publisher2.2.21 of 1See more

rtsp-to-web geek-cookbook 2.2.2

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/deepch/rtsptoweb:v2.2.0f9de3a1a5deb
github.com/pion/stun@v0.3.5
no fix listed

Open the chart page →

1,467
torrservergeek-cookbookVerified publisher1.2.21 of 1See more

torrserver geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
smailkoz/torrserver:1.0.1117b52d15de8f0
github.com/pion/stun@v0.3.5
no fix listed

Open the chart page →

3,165
infisical-gatewayinfisical-charts1.4.01 of 1See more

infisical-gateway infisical-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
infisical/cli:0.43.1230941c1293b77
github.com/pion/stun/v3@v3.0.0
3.1.5

Open the chart page →

285
erigoninfradao0.0.51 of 2See more

erigon infradao 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
testinprod/op-erigon:latest0a125bd77a2d
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

2,868
tor-proxykubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

tor-proxy kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
peterdavehello/tor-socks-proxy:latest0cc12d36d312
github.com/pion/stun/v3@v3.0.0
3.1.5

Open the chart page →

1,480
ingresslivekit-server1.2.21 of 1See more

ingress livekit-server 1.2.2

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
livekit/ingress:v1.2.21ab01641b366
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

10,716
livekit-serverlivekit-server1.9.01 of 1See more

livekit-server livekit-server 1.9.0

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
livekit/livekit-server:v1.9.03602a85840d5
github.com/pion/stun/v3@v3.0.0
3.1.5

Open the chart page →

1,552
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

2,444
firehose-ethereumnodeifyVerified publisher1.7.11 of 2See more

firehose-ethereum nodeify 1.7.1

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
github.com/pion/stun/v2@v2.0.0
no fix listed

Open the chart page →

5,565
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
github.com/pion/stun/v3@v3.0.0
3.1.5

Open the chart page →

4,749
firehose-ethereumpinaxVerified publisher0.3.21 of 2See more

firehose-ethereum pinax 0.3.2

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
github.com/pion/stun/v2@v2.0.0
no fix listed

Open the chart page →

7,062
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
github.com/pion/stun@v0.3.5
no fix listed

Open the chart page →

5,582
erigonstakewise2.61.21 of 3See more

erigon stakewise 2.61.2

1 of the 3 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
erigontech/erigon:v2.61.288706754b627
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

2,938
ipfsstakewise2.2.01 of 2See more

ipfs stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ipfs/kubo:v0.33.21a30f5ed8579
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

1,239
ssv-nodestakewise2.2.01 of 2See more

ssv-node stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
bloxstaking/ssv-node:v2.2.0bf6d7d2fdc93
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

6,779
v3-backendstakewise3.6.01 of 5See more

v3-backend stakewise 3.6.0

1 of the 5 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ipfs/kubo:v0.33.21a30f5ed8579
github.com/pion/stun@v0.6.1
no fix listed

Open the chart page →

1,239
mediamtxstartechnicaVerified publisher0.1.11 of 1See more

mediamtx startechnica 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
bluenviron/mediamtx:1.17.19e39256d1ba3
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

576
stunner-premiumstunner1.2.11 of 2See more

stunner-premium stunner 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
l7mp/stunner-auth-server:1.2.10d2094060b72
github.com/pion/stun/v3@v3.1.4
3.1.5

Open the chart page →

263
eth-validatorwateim1.4.51 of 3See more

eth-validator wateim 1.4.5

1 of the 3 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
ethereum/client-go:latest37575ec10fbc
github.com/pion/stun/v3@v3.1.2
3.1.5

Open the chart page →

4,998
rancherwenerme2.15.11 of 2See more

rancher wenerme 2.15.1

1 of the 2 container images this version deploys carry CVE-2026-54909.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
github.com/pion/stun/v3@v3.1.1
3.1.5

Open the chart page →

1,456

Container images carrying it

66 by charts deploying them

A fixed version is listed for 1 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/chronicleprotocol/ghost:0.78.5951d71162065
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.1.1
no fix listed
3.1.5
1
ghcr.io/chronicleprotocol/spectre:0.68.34e872bc016e8
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5
1
ghcr.io/chronicleprotocol/spire:0.68.379df4fb20322
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5
1
ghcr.io/deepch/rtsptoweb:v2.2.0f9de3a1a5deb
github.com/pion/stun@v0.3.5
no fix listed
1
ghcr.io/element-hq/lk-jwt-service:0.6.0822f0c03a3bd
github.com/pion/stun/v3@v3.1.4
3.1.5
1
ghcr.io/gla-rad/mc-mms-router:latest032e977d9adf
github.com/pion/stun@v0.6.1
github.com/pion/stun/v3@v3.0.0
no fix listed
3.1.5
1
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
github.com/pion/stun/v3@v3.1.1
3.1.5
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
github.com/pion/stun/v3@v3.1.1
3.1.5
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
github.com/pion/stun/v3@v3.0.0
3.1.5
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
github.com/pion/stun/v3@v3.1.1
3.1.5
1
ghcr.io/ptrvsrg/csi-driver-ipfs:latest97d2d9ccd7a5
github.com/pion/stun/v3@v3.1.1
3.1.5
1
ghcr.io/spegel-org/spegel26c60b05e08a
github.com/pion/stun/v3@v3.1.1
3.1.5
1
ghcr.io/streamingfast/firehose-ethereum:v2.12.4-gethd7bdfa7b41da
github.com/pion/stun/v2@v2.0.0
no fix listed
1
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
github.com/pion/stun/v2@v2.0.0
no fix listed
1
ghcr.io/twigex/cospace:lateste5ecfd607e42
github.com/pion/stun@v0.6.1
no fix listed
1
quay.io/go-skynet/local-ai:latestd78cd113b2bc
github.com/pion/stun/v3@v3.1.1
3.1.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.