CVE-2026-41682mediumCWE-195CWE-918

CVE-2026-41682: falha de média gravidade em pupnp

pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pupnp+ Monitorar pupnp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%
pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
pupnp · pupnp
CVEs relacionadas — pupnp

No mesmo produto, das mais perigosas para as menos.

CVE-2021-29462HIGHDNS rebinding in pupnpEPSS 0.6%CVE-2026-55862MEDIUMpupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflowEPSS 0.5%CVE-2026-57487HIGHlibupnp chunked HTTP bodies can bypass g_maxContentLength and be fully bufferedEPSS 0.4%CVE-2026-57486HIGHpupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributesEPSS 0.4%CVE-2026-77630HIGHpupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsingEPSS 0.3%CVE-2026-57488HIGHpupnp: Integer truncation in HTTP Content-Length parsing enables request smugglingEPSS 0.3%