Hi,

The following vulnerabilities were published for pupnp.

CVE-2026-77630[0]:
| pupnp is an SDK for development of UPnP device and control point
| applications. Prior to 22.0.4, parse_hostport in
| upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while
| parse_uri is processing attacker-supplied hostnames from inbound
| HTTP request targets in upnp/src/genlib/net/http/httpparser.c and
| GENA SUBSCRIBE CALLBACK headers handled by create_url_list in
| upnp/src/gena/gena_device.c. A remote unauthenticated peer can
| choose a slow or nonresponsive hostname and block a bounded
| miniserver worker for the resolver timeout, allowing a small number
| of requests to exhaust the thread pool and deny UPnP service. This
| issue is fixed in 22.0.4.

https://github.com/pupnp/pupnp/security/advisories/GHSA-46ph-jff5-5h77
https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2 (release-22.0.4)

CVE-2026-57488[1]:
| pupnp is an SDK for development of UPnP device and control point
| applications. Prior to 2.0.2, raw_to_int in
| upnp/src/genlib/net/http/httpparser.c parses Content-Length with
| strtol and casts the resulting long to a 32-bit int before the
| caller stores it as unsigned int. On LP64 systems, values greater
| than INT_MAX can truncate or wrap, so the HTTP parser can accept a
| body length different from the declared value. A remote adjacent-
| network peer can use the resulting parser disagreement to leave
| bytes to be interpreted as another request in persistent or proxied
| contexts, or can make a worker wait for an extremely large body and
| cause denial of service. This issue is fixed in 2.0.2.

https://github.com/pupnp/pupnp/security/advisories/GHSA-g6c2-x4r9-352g
https://github.com/pupnp/pupnp/commit/de9602aef34ff722f3630d66c9be8eaa0aa9f012 (release-2.0.2)

CVE-2026-57487[2]:
| pupnp is an SDK for development of UPnP device and control point
| applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the
| HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave
| parser->content_length at zero while parser_parse_chunky_entity and
| parser_parse_chunky_body accumulate decoded bytes in
| parser->msg.entity. The g_maxContentLength checks in
| http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c
| therefore reject oversized numeric Content-Length bodies but do not
| enforce the same limit on decoded chunked bodies. A remote peer that
| can reach a SOAP, GENA, miniserver, or control-point HTTP response
| path can make the process buffer an entity larger than the
| configured maximum, causing resource exhaustion and denial of
| service. This issue is fixed in 2.0.2.

https://github.com/pupnp/pupnp/security/advisories/GHSA-gcj7-j9f7-q84c
https://github.com/pupnp/pupnp/commit/9ff9bc583ad8ee4ba022634434a7b71db9bd96e1 (release-2.0.2)

CVE-2026-57486[3]:
| pupnp is an SDK for development of UPnP device and control point
| applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c
| passes the nullable nodeValue, namespaceURI, prefix, and localName
| fields directly to strcmp. Non-namespaced attributes created by
| ixmlDocument_createAttribute legitimately leave those fields NULL.
| When ixmlElement_removeAttributeNode compares two distinct attribute
| objects with the same nodeName through find_condition_node, the
| pointer-identity shortcut does not apply and the comparison
| dereferences NULL, causing a process crash when application handling
| of attacker-controlled XML reaches this path. This issue is fixed in
| 2.0.2.

https://github.com/pupnp/pupnp/security/advisories/GHSA-q54q-vx78-v9rq
https://github.com/pupnp/pupnp/commit/4b2f775e3b98de3cfb096707bcde040c5562d9ec (release-2.0.2)

CVE-2026-55862[4]:
| pupnp is an SDK for development of UPnP device and control point
| applications. Prior to 2.0.0, multiple ixml DOM traversal functions
| process deeply nested XML with unbounded recursion. The iterative
| XML parser accepts the document, but ixmlPrintDomTreeRecursive in
| ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive,
| ixmlNode_getElementsByTagNameNSRecursive,
| ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in
| ixml/src/node.c recurse over firstChild and nextSibling links. An
| unauthenticated peer on the local network can supply deeply nested
| XML through a SOAP request, exhaust a service thread's stack, and
| crash the UPnP service. This is an incomplete-fix case for
| CVE-2021-28302 because its remediation converted ixmlNode_free but
| left these traversal paths recursive. This issue is fixed in 2.0.0.

https://github.com/pupnp/pupnp/security/advisories/GHSA-25cx-xv8x-j247
https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4 (release-2.0.0)

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-77630
https://www.cve.org/CVERecord?id=CVE-2026-77630
[1] https://security-tracker.debian.org/tracker/CVE-2026-57488
https://www.cve.org/CVERecord?id=CVE-2026-57488
[2] https://security-tracker.debian.org/tracker/CVE-2026-57487
https://www.cve.org/CVERecord?id=CVE-2026-57487
[3] https://security-tracker.debian.org/tracker/CVE-2026-57486
https://www.cve.org/CVERecord?id=CVE-2026-57486
[4] https://security-tracker.debian.org/tracker/CVE-2026-55862
https://www.cve.org/CVERecord?id=CVE-2026-55862

Please adjust the affected versions in the BTS as needed.

This is an automated message from the Debian DFSG, Licensing & New
Packages Team.

The Debian NEW review of pupnp 1:22.1.8-1 has been completed.

Decision: ACCEPTED
Reviewer: Andrew McMillan

Review comment:

Hi,

The first line of a DEP-5 format copyright file needs to be exactly:

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/

Yours is missing a trailling '/' which, though trivial, causes some tools to fail to parse it.

The LLM Review identified a couple of other issues that you may, or may not consider worth looking at. FWIW, if there's no source for the PDF that it is grumpy about due to the vicissitudes of time, then I don't think removing it is necessarily the correct answer - if it provides value then it should remain as-is.

Thanks!

Full review details: https://dfsg-new-queue.debian.org/reviews/pupnp

We believe that the bug you reported is fixed in the latest version of
pupnp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151082@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sebastian Ramacher <sramacher@debian.org> (supplier of updated pupnp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 17 Oct 2026 18:38:31 +0200
Binary: libixml22 libixml22-dbgsym libupnp22 libupnp22-dbgsym libupnp-dev libupnp-doc
Source: pupnp
Architecture: all amd64 source
Version: 1:22.1.8-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Changed-By: Sebastian Ramacher <sramacher@debian.org>
Closes: 1151082
Description:
 libixml22  - Portable SDK for UPnP Devices (ixml shared library)
 libupnp22  - Portable SDK for UPnP Devices (shared library)
 libupnp-dev - Portable SDK for UPnP Devices, version 1.14 (development files)
 libupnp-doc - Documentation for the Portable SDK for UPnP Devices
Changes:
 pupnp (1:22.1.8-1) experimental; urgency=medium
 .
   * New upstream version 22.1.8
     - Fixes CVE-2026-77630, CVE-2026-57488, CVE-2026-57487, CVE-2026-57486,
       and CVE-2026-55862 (Closes: #1151082)
   * SONAME bump:
     - libupnp20 -> libupnp22
     - libixml11 -> libixml22
   * debian/control:
     - Bump debhelper compat to 14
     - Bump Standards-Version
   * debian/copyright: Update copyright info for 22.1.8
Checksums-Sha1:
 0cc52593b82a3858d7f51673c16ccdbac79667da 1690 pupnp_22.1.8-1.dsc
 b289ff121803c7ed35d56fa5e6069bc851d33e55 918872 pupnp_22.1.8.orig.tar.gz
 efee2c9a5b4c605d5b1e26886bd1ea6e75fea103 13828 pupnp_22.1.8-1.debian.tar.xz
 1740ce7da422a2a4e12ab2141685e5320baf3029 65916 libixml22-dbgsym_22.1.8-1_amd64.deb
 bce234d6ec2f2eb1321ba3bc053216d98114bfc8 92320 libixml22_22.1.8-1_amd64.deb
 d6a3aeb5ee34952c6f18cfe6ab8a6670dd71e91e 109944 libupnp-dev_22.1.8-1_amd64.deb
 d9ef6ee7a027152ca873d4e9154b25e1742ea53d 29370852 libupnp-doc_22.1.8-1_all.deb
 ebb10f9938d4ef539f4aa763aa61b861c7b16e77 390440 libupnp22-dbgsym_22.1.8-1_amd64.deb
 0a5ce0132e5b86a75ff11604f2bd42e1a3890fa5 186700 libupnp22_22.1.8-1_amd64.deb
 8ed1956c2aa783d6246396ce955f22b016fb5dae 9491 pupnp_22.1.8-1_amd64.buildinfo
Checksums-Sha256:
 2a2d225015a1542ae21be255ecbd5fdc65b446b5b6dad12517a9190950ca64a9 1690 pupnp_22.1.8-1.dsc
 fa8d978919ff283a23aeb8635bec44dc84879f6bbc51562f7bdd5aef85dcdf66 918872 pupnp_22.1.8.orig.tar.gz
 d8804ab1ed43e48828dc268b2d5287f233b58b693836b7299e2586759ca04db4 13828 pupnp_22.1.8-1.debian.tar.xz
 5163062ecf9007cd9ea9a4e8d91ef693e3e913af3dda9b939e573a039840d958 65916 libixml22-dbgsym_22.1.8-1_amd64.deb
 b3ed54daa4c9f2803abdf8351e7a7f8159f41d5da228440adf8e33c3b53ebaad 92320 libixml22_22.1.8-1_amd64.deb
 92f15b386eb97f5f3833f561343053e845f909ca2b0a09b55df84074a03d6da2 109944 libupnp-dev_22.1.8-1_amd64.deb
 47e758353d9d8b1b58b3b4f4bb0f795f7e883efc2b39fe55effb700dfc97933d 29370852 libupnp-doc_22.1.8-1_all.deb
 ea74868bb2c686e29b1bef42460e715af0f4c03fb4b70f123a4c8c76d8aa1973 390440 libupnp22-dbgsym_22.1.8-1_amd64.deb
 1888a925fd467ade726d9a050f635292fc7364b23c2607e8060c829a58c7c8f0 186700 libupnp22_22.1.8-1_amd64.deb
 1e4b513d264c49dd101929d673717ce267f88217a50b9944df43b62da223753a 9491 pupnp_22.1.8-1_amd64.buildinfo
Files:
 62ee8d6e410821283f808fd129839ed0 1690 net optional pupnp_22.1.8-1.dsc
 b8db42773406a601585e53be51920dd0 918872 net optional pupnp_22.1.8.orig.tar.gz
 07a3bd3e15bd317ea79b843ee00b9f97 13828 net optional pupnp_22.1.8-1.debian.tar.xz
 efb7899d63f4c8674cf1b5f64f9699f5 65916 debug optional libixml22-dbgsym_22.1.8-1_amd64.deb
 4d34364c21716b827fa555d9b29b3146 92320 libs optional libixml22_22.1.8-1_amd64.deb
 07d2deaa54f1bb6ce1f7e2ebe2ec03d7 109944 libdevel optional libupnp-dev_22.1.8-1_amd64.deb
 77381010018452a5f9942dfc198c91eb 29370852 doc optional libupnp-doc_22.1.8-1_all.deb
 b8902af25e0bae661a5dac479cec1e6e 390440 debug optional libupnp22-dbgsym_22.1.8-1_amd64.deb
 9e7c267870db5674dc73f15a664ef975 186700 libs optional libupnp22_22.1.8-1_amd64.deb
 ec2975fb90c1a1fe953f7f87240c81db 9491 net optional pupnp_22.1.8-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

wr0EARYKAG8FgmrTpRYJECGTazZgD82JRxQAAAAAAB4AIHNhbHRAbm90YXRpb25z
LnNlcXVvaWEtcGdwLm9yZ1vOz6HsPhZpVuAijzNyLzeaNk0cRTHgYTH9co9NTdN2
FiEEQmJ+hB2ZZ9qD4fqQIZNrNmAPzYkAAK3QAQC/RhT506ZlEJ/7sy8hNSOnA/Qt
vHhLn1XynkLQjCOD7wD9HXLzIzsUXw8QOXuf1/xSgjR5lAVzjRYu90NJogQtOQw=
=sq+v
-----END PGP SIGNATURE-----