Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pupnp | pupnp | < 22.0.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pupnp | 1:22.1.8-2 | — |
| Debian 13 | pupnp | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pupnp | No fix yet | — |
| Ubuntu 26.04 LTS | pupnp | No fix yet | — |
| Ubuntu 24.04 LTS | pupnp | No fix yet | — |
| Ubuntu 22.04 LTS | pupnp-1.8 | No fix yet | — |
| Ubuntu 20.04 LTS | pupnp-1.8 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libupnp +1 | No fix yet | — |
| Ubuntu 16.04 LTS | mediatomb | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libupnp | No fix yet | — |