Read the docs
TI-2026-30199 Aliases CVE-2026-41682

pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion

Priority LOW 36CWE-195Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00346 28th percentileScored 2026-11-07
Fix Fixed pupnp (pupnp): 1.18.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pupnppupnpbefore 1.18.51.18.5Patch availableCNA
  • pupnp Vendorpupnp Affected before 1.18.5 Fixed in 1.18.5 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:*——pupnp
  • cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:* Versions — — ·pupnp

Remediation

  • Fix · CNA pupnp (pupnp) Fixed in 1.18.5

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41682

References

Other 3

  • TI-2026-75352 pupnp: NULL pointer dereference in ixmlNode_compare, non-namespaced attributes CVSS 3.1HIGH 7.5
  • TI-2026-75354 pupnp Content-Length integer truncation enables request smuggling CVSS 3.1HIGH 7.1
  • TI-2026-75349 Uncontrolled recursion in pupnp DOM functions causes stack overflow CVSS 3.1MEDIUM 6.5
  • TI-2021-10175 DNS rebinding in pupnp CVSS 3.1CRITICAL 9.8
  • TI-2026-75358 Blocking DNS lookups in pupnp allow denial of service CVSS 3.1HIGH 7.5
  • TI-2026-75353 Chunked HTTP bodies in libupnp bypass the size limit CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences