CVE catalog
CVE-2021-29462
pupnp-1.8: CVE-2021-29462
- Severity
- Critical · CVSS 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.63% · Oct 25, 2026
The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the `Host` header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | pupnp-1.8 | bookworm | 1:1.8.4-2 | vulnerable |
| Ubuntu | libupnp | pro | 1:1.6.19+git20141001-1 | vulnerable |
| Ubuntu | libupnp | pro | 1:1.6.19+git20141001-1ubuntu1 | vulnerable |
| Ubuntu | libupnp | pro | 1:1.6.19+git20160116-1 | vulnerable |
| Ubuntu | libupnp | pro | 1:1.6.19+git20160116-1ubuntu0.1~esm1 | vulnerable |
| Ubuntu | mediatomb | 16.04 | 0.12.1-47-g7ab7616-1ubuntu1 | vulnerable |
| Ubuntu | mediatomb | 16.04 | 0.12.1-47-g7ab7616-1ubuntu2 | vulnerable |
| Ubuntu | libupnp | 18.04 | 1:1.6.22-1 | vulnerable |
| Ubuntu | libupnp | 18.04 | 1:1.6.24-1 | vulnerable |
| Ubuntu | libupnp | 18.04 | 1:1.6.24-2 | vulnerable |
| Ubuntu | libupnp | 18.04 | 1:1.6.24-3 | vulnerable |
| Ubuntu | libupnp | 18.04 | 1:1.6.24-4 | vulnerable |
| Ubuntu | pupnp-1.8 | 18.04 | 1:1.8.2-2 | vulnerable |
| Ubuntu | pupnp-1.8 | 18.04 | 1:1.8.2-3 | vulnerable |
| Ubuntu | pupnp-1.8 | 20.04 | 1:1.8.4-2ubuntu2 | vulnerable |
| Ubuntu | pupnp-1.8 | 22.04 | 1:1.8.4-2ubuntu2 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | pupnp-1.8 | source | bookworm | (unfixed) | not yet assigned | Not reported | [987326] |
Notes
[bookworm] pupnp-1.8: Minor issue
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libixml10]Affected
Source package: [pupnp-1.8]
Details (2)
1:1.8.4-2· amd64 · bookwormAffected
dsa · pupnp-1.8 · debian · bookworm; dsa · pupnp-1.8 · debian · 12
1:1.8.4-2· arm64 · bookwormAffected
dsa · pupnp-1.8 · debian · bookworm; dsa · pupnp-1.8 · debian · 12
- [libupnp13]Affected
Source package: [pupnp-1.8]
Details (2)
1:1.8.4-2· amd64 · bookwormAffected
dsa · pupnp-1.8 · debian · bookworm; dsa · pupnp-1.8 · debian · 12
1:1.8.4-2· arm64 · bookwormAffected
dsa · pupnp-1.8 · debian · bookworm; dsa · pupnp-1.8 · debian · 12
- [libupnp-dev]Affected
Source package: [pupnp-1.8]
Details (2)
1:1.8.4-2· amd64 · bookwormAffected
dsa · pupnp-1.8 · debian · bookworm; dsa · pupnp-1.8 · debian · 12
1:1.8.4-2· arm64 · bookwormAffected
dsa · pupnp-1.8 · debian · bookworm; dsa · pupnp-1.8 · debian · 12
- [libupnp-doc]Affected
Source package: [pupnp-1.8]
Details (2)
1:1.8.4-2· all · bookwormAffected
dsa · pupnp-1.8 · debian · bookworm; dsa · pupnp-1.8 · debian · 12
1:1.8.4-2· all · bookwormAffected
dsa · pupnp-1.8 · debian · bookworm; dsa · pupnp-1.8 · debian · 12
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11006-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-29462]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2021-29462]
- [https://security-tracker.debian.org/tracker/CVE-2021-29462]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]