CVE-2026-26014 affects github.com/pion/dtls/v2, currently pulled in
transitively via github.com/pion/stun/v2 v2.0.0. The fix lives in
github.com/pion/dtls/v3, which github.com/pion/stun/v3 already uses.
The v3 API surface used by p2p/nat/stun.go (Dial, Build, TransactionID,
BindingRequest, Event, XORMappedAddress, DefaultPort) is identical to
v2 in shape and behaviour, so the source change is just an import
rename plus matching alias rename (stunV2 -> stunV3). go mod tidy
drops every dtls/v2 and stun/v2 entry from go.sum and pulls in
dtls/v3 v3.0.7 / stun/v3 v3.0.1 / transport/v3 v3.0.8 as the new
indirect set.
Verified:
- go build ./p2p/nat/ clean.
- go test ./p2p/nat/ clean (26s).
- grep 'pion/dtls/v2\\|pion/stun/v2' go.sum returns 0 matches.
Closes#34621
ac53e42b9c