VDB
CVE-2026-41682
CVE-2026-41682
PUBLISHED
CVSS 6.9 MEDIUM
Reported by GitHub_M · Published May 8, 2026
pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.
EPSS 0.35% · 27.9th percentile
Risk Scores
CVSS 4.0
6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.35%
27.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| pupnp | pupnp | < 1.18.5 |
| pupnp | pupnp | < 1.18.5 |
Timeline
- Apr 28, 2026 CVE Published
- May 10, 2026 Security Advisory
- May 11, 2026 CVE Updated
- May 18, 2026 EPSS Score
- May 19, 2026 EPSS Score
- May 21, 2026 EPSS Score
- May 22, 2026 EPSS Score
- May 23, 2026 EPSS Score
- May 25, 2026 EPSS Score
- May 26, 2026 EPSS Score
- May 27, 2026 EPSS Score
- May 28, 2026 EPSS Score
References
- https://github.com/pupnp/pupnp/security/advisories/GHSA-q522-6w45-4j58 x_refsource_CONFIRM
- https://github.com/pupnp/pupnp/commit/def5f9a2bc42f5b3d713e37c516fbe840ce54b7b x_refsource_MISC
- https://github.com/pupnp/pupnp/releases/tag/release-1.18.5 x_refsource_MISC