CVE-2026-41682

Name	CVE-2026-41682
Description	pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pupnp (PTS)	trixie	1:1.14.20-1	vulnerable
	forky, sid	1:1.14.31-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
pupnp	source	(unstable)	1:1.14.31-1

Notes

[trixie] - pupnp <no-dsa> (Minor issue)
https://github.com/pupnp/pupnp/security/advisories/GHSA-q522-6w45-4j58
https://github.com/pupnp/pupnp/commit/58021a7600876c77403e2e06eb19d21efc196d21 (release-1.14.31)