Medium
libupnp, mediatomb and 2 more products — security advisory
pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.
- Products
- libupnp, mediatomb, pupnp, pupnp-1.8
- Affected versions
- 0.12.1-47-g7ab7616-1ubuntu1, 0.12.1-47-g7ab7616-1ubuntu2, 1:1.14.18-1.1ubuntu1, 1:1.14.18-1.1ubuntu2, 1:1.14.18-1ubuntu1, 1:1.14.20-1ubuntu1, 1:1.14.24-2ubuntu1, 1:1.14.24-3ubuntu1, 1:1.14.25-1ubuntu1, 1:1.14.31-1ubuntu1, 1:1.14.31-1ubuntu2, 1:1.6.19+git20141001-1, 1:1.6.19+git20141001-1ubuntu1, 1:1.6.19+git20160116-1, 1:1.6.19+git20160116-1ubuntu0.1~esm1, 1:1.6.22-1, 1:1.6.24-1, 1:1.6.24-2, 1:1.6.24-3, 1:1.6.24-4, 1:1.8.2-2, 1:1.8.2-3, 1:1.8.4-2ubuntu2
- Fixed versions
- Not specified
- CVEs
- CVE-2026-41682
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:11 UTC · Revision 1
Source evidence
pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.
osv:UBUNTU-CVE-2026-41682
libupnp
Fixed versions: Not specified
mediatomb
Fixed versions: Not specified
libupnp
Fixed versions: Not specified
pupnp-1.8
Fixed versions: Not specified
pupnp-1.8
Fixed versions: Not specified
pupnp-1.8
Fixed versions: Not specified
pupnp
Fixed versions: Not specified
pupnp
Fixed versions: Not specified
pupnp
Fixed versions: Not specified
pupnp
Fixed versions: Not specified
Complete source record
{
"id": "85b775ad3b23c11b26496eab5cb979fd68347ee3e76ac20385c02bd851850962",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-41682",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-41682",
"summary": "pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.",
"evidence": "osv:UBUNTU-CVE-2026-41682",
"products": [
{
"name": {
"value": "libupnp",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.6.19+git20141001-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.6.19+git20141001-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.6.19+git20160116-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.6.19+git20160116-1ubuntu0.1~esm1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "mediatomb",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "0.12.1-47-g7ab7616-1ubuntu1",
"evidence": "/affected/1/versions"
},
{
"value": "0.12.1-47-g7ab7616-1ubuntu2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "libupnp",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.6.22-1",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.6.24-1",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.6.24-2",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.6.24-3",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.6.24-4",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "pupnp-1.8",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.8.2-2",
"evidence": "/affected/3/versions"
},
{
"value": "1:1.8.2-3",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "pupnp-1.8",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.8.4-2ubuntu2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "pupnp-1.8",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.8.4-2ubuntu2",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "pupnp",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.14.18-1ubuntu1",
"evidence": "/affected/6/versions"
},
{
"value": "1:1.14.18-1.1ubuntu1",
"evidence": "/affected/6/versions"
},
{
"value": "1:1.14.18-1.1ubuntu2",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "pupnp",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.14.20-1ubuntu1",
"evidence": "/affected/7/versions"
},
{
"value": "1:1.14.24-2ubuntu1",
"evidence": "/affected/7/versions"
},
{
"value": "1:1.14.24-3ubuntu1",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "pupnp",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.14.25-1ubuntu1",
"evidence": "/affected/8/versions"
},
{
"value": "1:1.14.31-1ubuntu1",
"evidence": "/affected/8/versions"
},
{
"value": "1:1.14.31-1ubuntu2",
"evidence": "/affected/8/versions"
}
]
},
{
"name": {
"value": "pupnp",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.14.24-3ubuntu1",
"evidence": "/affected/9/versions"
},
{
"value": "1:1.14.25-1ubuntu1",
"evidence": "/affected/9/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-41682",
"aliases": [
"UBUNTU-CVE-2026-41682"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libupnp",
"purl": "pkg:deb/ubuntu/libupnp?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"1:1.6.19+git20141001-1",
"1:1.6.19+git20141001-1ubuntu1",
"1:1.6.19+git20160116-1",
"1:1.6.19+git20160116-1ubuntu0.1~esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41682.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libupnp6",
"binary_version": "1:1.6.19+git20160116-1ubuntu0.1~esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "mediatomb",
"purl": "pkg:deb/ubuntu/mediatomb?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"0.12.1-47-g7ab7616-1ubuntu1",
"0.12.1-47-g7ab7616-1ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41682.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "mediatomb",
"binary_version": "0.12.1-47-g7ab7616-1ubuntu2"
},
{
"binary_name": "mediatomb-common",
"binary_version": "0.12.1-47-g7ab7616-1ubuntu2"
},
{
"binary_name": "mediatomb-daemon",
"binary_version": "0.12.1-47-g7ab7616-1ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "libupnp",
"purl": "pkg:deb/ubuntu/libupnp?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1:1.6.22-1",
"1:1.6.24-1",
"1:1.6.24-2",
"1:1.6.24-3",
"1:1.6.24-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41682.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libupnp6",
"binary_version": "1:1.6.24-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pupnp-1.8",
"purl": "pkg:deb/ubuntu/pupnp-1.8?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1:1.8.2-2",
"1:1.8.2-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41682.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libixml10",
"binary_version": "1:1.8.2-3"
},
{
"binary_name": "libupnp10",
"binary_version": "1:1.8.2-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pupnp-1.8",
"purl": "pkg:deb/ubuntu/pupnp-1.8?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1:1.8.4-2ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41682.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libixml10",
"binary_version": "1:1.8.4-2ubuntu2"
},
{
"binary_name": "libupnp13",
"binary_version": "1:1.8.4-2ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pupnp-1.8",
"purl": "pkg:deb/ubuntu/pupnp-1.8?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1:1.8.4-2ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41682.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libixml10",
"binary_version": "1:1.8.4-2ubuntu2"
},
{
"binary_name": "libupnp13",
"binary_version": "1:1.8.4-2ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pupnp",
"purl": "pkg:deb/ubuntu/pupnp?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1:1.14.18-1ubuntu1",
"1:1.14.18-1.1ubuntu1",
"1:1.14.18-1.1ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41682.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libixml11t64",
"binary_version": "1:1.14.18-1.1ubuntu2"
},
{
"binary_name": "libupnp17t64",
"binary_version": "1:1.14.18-1.1ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pupnp",
"purl": "pkg:deb/ubuntu/pupnp?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1:1.14.20-1ubuntu1",
"1:1.14.24-2ubuntu1",
"1:1.14.24-3ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41682.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libixml11t64",
"binary_version": "1:1.14.24-3ubuntu1"
},
{
"binary_name": "libupnp17t64",
"binary_version": "1:1.14.24-3ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pupnp",
"purl": "pkg:deb/ubuntu/pupnp?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1:1.14.25-1ubuntu1",
"1:1.14.31-1ubuntu1",
"1:1.14.31-1ubuntu2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41682.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libixml11t64",
"binary_version": "1:1.14.31-1ubuntu2"
},
{
"binary_name": "libupnp17t64",
"binary_version": "1:1.14.31-1ubuntu2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "pupnp",
"purl": "pkg:deb/ubuntu/pupnp?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1:1.14.24-3ubuntu1",
"1:1.14.25-1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-41682.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libixml11t64",
"binary_version": "1:1.14.25-1ubuntu1"
},
{
"binary_name": "libupnp17t64",
"binary_version": "1:1.14.25-1ubuntu1"
}
]
}
}
],
"modified": "2026-10-17T12:58:16.201740194Z",
"provider": "osv",
"upstream": [
"CVE-2026-41682"
],
"references": [
"https://ubuntu.com/security/CVE-2026-41682",
"https://www.cve.org/CVERecord?id=CVE-2026-41682",
"https://github.com/pupnp/pupnp/security/advisories/GHSA-q522-6w45-4j58",
"https://github.com/pupnp/pupnp/commit/58021a7600876c77403e2e06eb19d21efc196d21"
]
},
"related_cves": [
{
"value": "CVE-2026-41682",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 358480,
"published_at": "2026-05-08T23:16:00+00:00"
}