Skip to content
OpenAdvisories
High · 7.5 CVE-2026-77630 EUVD-2026-102933

pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing

Published Oct 16, 2026 · Updated Oct 16, 2026 · Assigned by GitHub_M

Description

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

Affected products

VendorProductAffectedFixed
pupnp pupnp < 22.0.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 pupnp 1:22.1.8-2 —
Debian 13 pupnp No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 pupnp No fix yet —
Ubuntu 26.04 LTS pupnp No fix yet —
Ubuntu 24.04 LTS pupnp No fix yet —
Ubuntu 22.04 LTS pupnp-1.8 No fix yet —
Ubuntu 20.04 LTS pupnp-1.8 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS libupnp +1 No fix yet —
Ubuntu 16.04 LTS mediatomb No fix yet —
Ubuntu Pro 16.04 LTS libupnp No fix yet —

References