DEBIAN-CVE-2026-41682

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-41682
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41682.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-41682
Upstream
Published
2026-05-08T23:16:35Z
Modified
2026-09-14T17:03:11Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.

References

Affected packages

Debian:13 / pupnp

Package

Name
pupnp
Purl
pkg:deb/debian/pupnp?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:1.14.20-1+deb13u1

Affected versions

1:1.*
1:1.14.20-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41682.json"

Debian:14 / pupnp

Package

Name
pupnp
Purl
pkg:deb/debian/pupnp?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1:1.14.31-1

Affected versions

1:1.*
1:1.14.20-1
1:1.14.23-1
1:1.14.24-1
1:1.14.24-2
1:1.14.24-3
1:1.14.25-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-41682.json"