Description
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| miniupnp project | miniupnpd | ≤ 2.3.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | miniupnpd | No fix yet | — |
| Debian 13 | miniupnpd | No fix yet | — |
| Debian 12 | miniupnpd | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | miniupnpd | No fix yet | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | miniupnpd | No fix yet | — |
| Ubuntu Pro 24.04 LTS | miniupnpd | No fix yet | — |
| Ubuntu Pro 22.04 LTS | miniupnpd | No fix yet | — |
| Ubuntu Pro 20.04 LTS | miniupnpd | No fix yet | — |
| Ubuntu Pro 18.04 LTS | miniupnpd | No fix yet | — |
| Ubuntu Pro 16.04 LTS | miniupnpd | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
azuk4r/CVE-2026-107159 ★ 1 · Oct 13, 2026
MiniUPnPd <= 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- Patch Commit patch
- https://github.com/miniupnp/miniupnp product
- https://github.com/miniupnp/miniupnp/blob/miniupnpd_2_3_11/miniupnpd/minissdp.c#L1143-L1158 technical-description
- https://github.com/miniupnp/miniupnp/blob/miniupnpd_2_3_11/miniupnpd/minissdp.c#L1281 technical-description
- VulnCheck Advisory: MiniUPnPd through 2.3.11 Divide-by-Zero DoS via SSDP M-SEARCH MX Header third-party-advisory