Medium severity · published May 8, 2026
CVE-2026-41682
pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion
6.9
CVSS
0.3%
EPSS
No
On KEV
Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
pupnp · pupnp
< 1.18.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41682
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41682
github.com
https://github.com/pupnp/pupnp/commit/def5f9a2bc42f5b3d713e37c516fbe840ce54b7b
github.com
https://github.com/pupnp/pupnp/releases/tag/release-1.18.5
github.com
https://github.com/pupnp/pupnp/security/advisories/GHSA-q522-6w45-4j58
More from pupnp
7.5
CVE-2026-77630
pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
7.5
CVE-2026-57487
libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
7.5
CVE-2026-57486
pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
7.1
CVE-2026-57488
pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
6.5
CVE-2026-55862
pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow