CVE-2026-41682 Overview
CVE-2026-41682 affects pupnp, a software development kit (SDK) used to build Universal Plug and Play (UPnP) device and control point applications. Versions prior to 1.18.5 contain a Server-Side Request Forgery (SSRF) port confusion flaw caused by numeric truncation in the parse_uri() function. The atoi() cast truncates port values, allowing an attacker to bypass port-based access controls by supplying crafted URIs that resolve to unintended ports. The maintainers patched the issue in pupnp 1.18.5.
Critical Impact
Remote, unauthenticated attackers can manipulate URI port parsing to coerce pupnp-based applications into contacting unintended network endpoints, weakening SSRF protections in UPnP devices.
Affected Products
- pupnp SDK versions prior to 1.18.5
- UPnP device applications built on vulnerable pupnp releases
- UPnP control point applications linked against vulnerable pupnp releases
Discovery Timeline
- 2026-05-08 - CVE-2026-41682 published to the National Vulnerability Database (NVD)
- 2026-05-13 - Last updated in NVD database
Technical Details for CVE-2026-41682
Vulnerability Analysis
The flaw resides in the parse_uri() routine inside pupnp. The function converts the textual port component of a Uniform Resource Identifier (URI) to an integer using atoi(). Because atoi() returns an int, values that exceed the 16-bit port range are silently truncated when the result is later assigned to a port field. An attacker can craft a URI whose displayed port differs from the port actually used during connection. This breaks any application logic that filters destinations based on the textual port string, enabling SSRF port confusion against pupnp consumers. The weakness is tracked as numeric truncation error [CWE-195].
Root Cause
The root cause is unsafe integer conversion in parse_uri(). atoi() performs no range validation, so a port string such as 65536 truncates to 0, and 131080 truncates to 8 (131080 mod 65536). Validation logic that inspects the original string sees one value, while the network stack connects to another.
Attack Vector
The vulnerability is reachable over the network without authentication or user interaction. An attacker supplies a malicious URI to any pupnp-based service that parses URIs originating from untrusted input, including UPnP control messages and HTTP callbacks. The truncated port enables requests to internal services that were intended to be unreachable through SSRF filtering.
No verified public exploit code is available. For technical specifics, refer to the GitHub Security Advisory GHSA-q522-6w45-4j58 and the GitHub Commit Details.
Detection Methods for CVE-2026-41682
Indicators of Compromise
- Inbound UPnP or HTTP requests containing URI port values greater than 65535 or with leading-zero or oversized port strings.
- Outbound connections from UPnP services to internal RFC1918 addresses on ports that do not match logged URI fields.
- Application logs from pupnp-linked binaries showing successful parsing of URIs whose textual port differs from the connected port.
Detection Strategies
- Inspect HTTP and Simple Service Discovery Protocol (SSDP) traffic for malformed port components in URI headers such as Location, Host, and Callback.
- Correlate URI parsing events with the destination port of subsequent outbound sockets to identify mismatches indicative of truncation.
- Run software composition analysis (SCA) against build artifacts to flag pupnp versions earlier than 1.18.5.
Monitoring Recommendations
- Monitor egress traffic from UPnP devices and gateways for unexpected connections to administrative or loopback services.
- Alert on UPnP control messages containing non-canonical port representations such as embedded whitespace, plus signs, or values exceeding five digits.
- Track version inventories of embedded SDKs and trigger review when pupnp components fall behind 1.18.5.
How to Mitigate CVE-2026-41682
Immediate Actions Required
- Upgrade pupnp to version 1.18.5 or later across all builds, firmware images, and dependent products.
- Rebuild and redeploy any application or device firmware that statically links pupnp.
- Inventory dependencies to identify downstream products embedding vulnerable pupnp versions.
Patch Information
The maintainers released the fix in pupnp 1.18.5. See the GitHub Release 1.18.5 for release notes and the GitHub Commit Details for the source-level fix that replaces the unsafe atoi() conversion with range-validated parsing.
Workarounds
- Restrict network exposure of UPnP services to trusted local segments using firewall rules until patching is complete.
- Disable UPnP functionality on devices that do not require it, particularly on internet-facing interfaces.
- Apply egress filtering on pupnp-based devices to block outbound connections to internal management ports.
# Configuration example: block UPnP service exposure on untrusted interfaces
iptables -A INPUT -i eth0 -p udp --dport 1900 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 49152:65535 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
