CVE-2026-77630
CVE-2026-77630 · pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
This page contains facts from public vulnerability sources. Check the original advisory before updating.
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.
CVSS 7.5 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
pupnp
- Versions
- < 22.0.4: Affected
No fix published
pupnp Debian:13
- Versions
- 1:1.14.20-1
- 1:1.14.20-1+deb13u1
- 1:1.14.23-1
- 1:1.14.24-1
- 1:1.14.24-2
- 1:1.14.24-3
- 1:1.14.25-1
- 1:1.14.31-1
- 1:1.18.0-1
- 1:1.18.4-1
- 1:1.18.5-1
- 1:22.1.8-1
- 1:22.1.8-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pupnp Debian:14
- Versions
- 1:1.14.20-1
- 1:1.14.23-1
- 1:1.14.24-1
- 1:1.14.24-2
- 1:1.14.24-3
- 1:1.14.25-1
- 1:1.14.31-1
- 1:1.18.0-1
- 1:1.18.4-1
- 1:1.18.5-1
- 1:22.1.8-1
- Affected ranges
- ECOSYSTEM: < 1:22.1.8-2
Update to 1:22.1.8-2
libupnp Ubuntu:Pro:16.04:LTS
- Versions
- 1:1.6.19+git20141001-1
- 1:1.6.19+git20141001-1ubuntu1
- 1:1.6.19+git20160116-1
- 1:1.6.19+git20160116-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mediatomb Ubuntu:16.04:LTS
- Versions
- 0.12.1-47-g7ab7616-1ubuntu1
- 0.12.1-47-g7ab7616-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
libupnp Ubuntu:18.04:LTS
- Versions
- 1:1.6.22-1
- 1:1.6.24-1
- 1:1.6.24-2
- 1:1.6.24-3
- 1:1.6.24-4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pupnp-1.8 Ubuntu:18.04:LTS
- Versions
- 1:1.8.2-2
- 1:1.8.2-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pupnp-1.8 Ubuntu:20.04:LTS
- Versions
- 1:1.8.4-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pupnp-1.8 Ubuntu:22.04:LTS
- Versions
- 1:1.8.4-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pupnp Ubuntu:24.04:LTS
- Versions
- 1:1.14.18-1ubuntu1
- 1:1.14.18-1.1ubuntu1
- 1:1.14.18-1.1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pupnp Ubuntu:26.10
- Versions
- 1:1.14.25-1ubuntu1
- 1:1.14.31-1ubuntu1
- 1:1.14.31-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
pupnp Ubuntu:26.04:LTS
- Versions
- 1:1.14.24-3ubuntu1
- 1:1.14.25-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published