High severity7.6NVD Advisory· Published Apr 20, 2021· Updated Jun 17, 2026

CVE-2021-29462

Description

The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the Host header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pupnp Project/Pupnp
cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:*
Range: <1.14.6
Portable SDK For UPnP Devices/libupnpllm-create
Range: >=1.14.6
Pupnp/libupnpllm-fuzzy
Range: >=1.14.6
Pupnp/Pupnpllm-fuzzy2 versions
>=1.14.6+ 1 more
- (no CPE)range: >=1.14.6
- (no CPE)range: < 1.14.6

Patches

Vulnerability mechanics

References

www.openwall.com/lists/oss-security/2021/04/20/4nvdMailing ListThird Party Advisory
github.com/pupnp/pupnp/security/advisories/GHSA-6hqq-w3jq-9fhgnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.494
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000