Catálogo de CVE

CVE-2026-41682

libixml11-1.18.5-1.1 on GA media

pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.

Gravidade: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published: Apr 28, 2026, 12:00:00 AM UTC
Updated: Oct 1, 2026, 3:03:23 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.35% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Opensusetumbleweed	libupnp	`1.18.5-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:10641-1]Apr 29, 2026, 8:02:10 AM UTC
Debian14	pupnp	`1:1.14.20-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.23-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.24-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.24-2`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.24-3`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.25-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.31-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian13	pupnp	`1:1.14.20-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian13	pupnp	`1:1.14.20-1+deb13u1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debian13	pupnp	`1:1.14.20-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian13	pupnp	`1:1.14.20-1+deb13u1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.20-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.23-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.24-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.24-2`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.24-3`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.25-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Debian14	pupnp	`1:1.14.31-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2026-41682]Oct 1, 2026, 3:03:23 AM UTC
Opensusetumbleweed	libupnp	`1.18.5-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:10641-1]Apr 29, 2026, 8:02:10 AM UTC

Original provider fields

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "pupnp",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:1.14.20-1+deb13u1"
            }
          ]
        }
      ],
      "release": "13",
      "versions": [
        "1:1.14.20-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-41682",
      "fixed_version": "1:1.14.20-1+deb13u1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-41682",
      "provider_updated_at": "2026-10-01T03:03:23.251882517Z",
      "applicability_unknown": true
    },
    {
      "name": "pupnp",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1:1.14.31-1"
            }
          ]
        }
      ],
      "release": "14",
      "versions": [
        "1:1.14.20-1",
        "1:1.14.23-1",
        "1:1.14.24-1",
        "1:1.14.24-2",
        "1:1.14.24-3",
        "1:1.14.25-1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-41682",
      "fixed_version": "1:1.14.31-1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2026-41682",
      "provider_updated_at": "2026-10-01T03:03:23.251882517Z",
      "applicability_unknown": true
    },
    {
      "name": "libupnp",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.18.5-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:10641-1",
      "fixed_version": "1.18.5-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:10641-1",
      "provider_updated_at": "2026-04-29T08:02:10.193024Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

A associação de pacotes está em andamento.

[Debian 13 (Trixie)]

[libixml11t64]Desconhecido
Pacote fonte: [pupnp]
Detalhes (2)
- 1:1.14.20-1+deb13u1 · amd64 · trixie
  Corrigida · Corrigida: 1:1.14.20-1+deb13u1
  pypi · pupnp · debian · 13
- 1:1.14.20-1+deb13u1 · arm64 · trixie
  Corrigida · Corrigida: 1:1.14.20-1+deb13u1
  pypi · pupnp · debian · 13
[libupnp17t64]Desconhecido
Pacote fonte: [pupnp]
Detalhes (2)
- 1:1.14.20-1+deb13u1 · amd64 · trixie
  Corrigida · Corrigida: 1:1.14.20-1+deb13u1
  pypi · pupnp · debian · 13
- 1:1.14.20-1+deb13u1 · arm64 · trixie
  Corrigida · Corrigida: 1:1.14.20-1+deb13u1
  pypi · pupnp · debian · 13
[libupnp-dev]Desconhecido
Pacote fonte: [pupnp]
Detalhes (2)
- 1:1.14.20-1+deb13u1 · amd64 · trixie
  Corrigida · Corrigida: 1:1.14.20-1+deb13u1
  pypi · pupnp · debian · 13
- 1:1.14.20-1+deb13u1 · arm64 · trixie
  Corrigida · Corrigida: 1:1.14.20-1+deb13u1
  pypi · pupnp · debian · 13
[libupnp-doc]Desconhecido
Pacote fonte: [pupnp]
Detalhes (2)
- 1:1.14.20-1+deb13u1 · all · trixie
  Corrigida · Corrigida: 1:1.14.20-1+deb13u1
  pypi · pupnp · debian · 13
- 1:1.14.20-1+deb13u1 · all · trixie
  Corrigida · Corrigida: 1:1.14.20-1+deb13u1
  pypi · pupnp · debian · 13

[openSUSE Tumbleweed]

[libixml22]Desconhecido
Pacote fonte: [libupnp]
Detalhes (1)
- 22.0.6-1.1 · x86_64 · tumbleweed
  Desconhecido · Corrigida: 1.18.5-1.1
  Version impact unknown
  pypi · libupnp · opensuse · tumbleweed
[libupnp22]Desconhecido
Pacote fonte: [libupnp]
Detalhes (1)
- 22.0.6-1.1 · x86_64 · tumbleweed
  Desconhecido · Corrigida: 1.18.5-1.1
  Version impact unknown
  pypi · libupnp · opensuse · tumbleweed
[libupnp-devel]Desconhecido
Pacote fonte: [libupnp]
Detalhes (1)
- 22.0.6-1.1 · x86_64 · tumbleweed
  Desconhecido · Corrigida: 1.18.5-1.1
  Version impact unknown
  pypi · libupnp · opensuse · tumbleweed

Observado: Oct 23, 2026, 10:26:20 PM UTC

Referências

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]