CVE-2026-41682CWE-195CWE-918

pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion

Medium · published May 8, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00480 · 40.5th percentile
Weaknesses
CWE-195 · Signed to Unsigned Conversion Error; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-05-08T22:47Z
EPSS history
Timeline
  • 08 MAY 22:47Z
    pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion
    cvelistv5