Read the docs
TI-2021-10175 Aliases CVE-2021-29462

DNS rebinding in pupnp

Priority MEDIUM 43CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-345.

Summary

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the `Host` header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.

Why it matters now

EPSS 0.00627 50th percentileScored 2026-11-07
Fix Fixed pupnp (pupnp): 1.14.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
pupnppupnpbefore 1.14.61.14.6Patch availableCNA
  • pupnp Vendorpupnp Affected before 1.14.6 Fixed in 1.14.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:*before 1.14.6Vulnerablepupnp
  • cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:* Versions before 1.14.6 Vulnerable ·pupnp

Remediation

  • Fix · CNA pupnp (pupnp) Fixed in 1.14.6

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29462
  2. 2026-10-30 EPSS moved to the 50th–90th percentile

References

Advisory 2

  • TI-2026-75352 pupnp: NULL pointer dereference in ixmlNode_compare, non-namespaced attributes CVSS 3.1HIGH 7.5
  • TI-2026-75354 pupnp Content-Length integer truncation enables request smuggling CVSS 3.1HIGH 7.1
  • TI-2026-75349 Uncontrolled recursion in pupnp DOM functions causes stack overflow CVSS 3.1MEDIUM 6.5
  • TI-2026-75358 Blocking DNS lookups in pupnp allow denial of service CVSS 3.1HIGH 7.5
  • TI-2026-75353 Chunked HTTP bodies in libupnp bypass the size limit CVSS 3.1HIGH 7.5
  • TI-2021-09467 A stack overflow in pupnp before version 1.14.5 can cause the denial of service through… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences