Vulnerability · Published May 8, 2026 · Assigned by GitHub_M
CVE-2026-41682pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion
Medium 6.9
In plain English
A medium-severity server-side request forgery in pupnp from pupnp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 71.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | pupnp | 1:1.14.20-1+deb13u1 | DEBIAN-CVE-2026-41682 |
| Debian:14 | pupnp | 1:1.14.31-1 | DEBIAN-CVE-2026-41682 |
| Ubuntu:24.04:LTS | pupnp | no fix listed | UBUNTU-CVE-2026-41682 |
| Ubuntu:25.10 | pupnp | no fix listed | UBUNTU-CVE-2026-41682 |
| Ubuntu:26.04:LTS | pupnp | no fix listed | UBUNTU-CVE-2026-41682 |
| Ubuntu:26.10 | pupnp | no fix listed | UBUNTU-CVE-2026-41682 |
| Ubuntu:22.04:LTS | pupnp-1.8 | no fix listed | UBUNTU-CVE-2026-41682 |
Affected products (as reported)
Weakness: CWE-195, CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/pupnp/pupnp/security/advisories/GHSA-q522-6w45-4j58 x_refsource_CONFIRM
- https://github.com/pupnp/pupnp/commit/def5f9a2bc42f5b3d713e37c516fbe840ce54b7b x_refsource_MISC
- https://github.com/pupnp/pupnp/releases/tag/release-1.18.5 x_refsource_MISC