| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| libupnp-22.0.4.tar.bz2 | 2026-07-15 | 772.7 kB | |
| libupnp-22.0.4.tar.bz2.sha256 | 2026-07-15 | 89 Bytes | |
| README.md | 2026-07-15 | 1.5 kB | |
| release-22.0.4 source code.tar.gz | 2026-07-15 | 874.4 kB | |
| release-22.0.4 source code.zip | 2026-07-15 | 1.1 MB | |
| Totals: 5 Items | 2.7 MB | 12 | |
Security fix
- OSS-Fuzz 531780528: Stop resolving DNS during URI/GENA callback parsing.
parse_hostport()calledgetaddrinfo()synchronously on any non-literal-IP host, andparse_uri()runs directly on untrusted input in two places: the HTTP request-line parser (embedded miniserver) and GENASUBSCRIBEcallback-URL parsing. A remote, unauthenticated peer could block a worker thread on DNS resolution (CWE-400).parse_uri()/parse_hostport()no longer perform DNS resolution; the newresolve_hostport()defers it to legitimate outbound-connection points. GENASUBSCRIBEcallback URLs now require a literal IP outright, closing a DNS-rebinding gap in the CVE-2020-12695 (CallStranger) same-subnet check as well.
Pushed directly to main (commits 5dba8070, 8b016a29, 0a03336b)
ahead of this release. A GHSA advisory will follow.
What's Changed
- fix: stop resolving DNS during URI/GENA callback parsing (OSS-Fuzz 531780528) in https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2
- test: add regression coverage for deferred DNS resolution in https://github.com/pupnp/pupnp/commit/8b016a29a8b087088903dda75b06ef7b9f4ec861
- Home keeping for release-22.0.3 by @mrjimenez in https://github.com/pupnp/pupnp/pull/625
- docs: add 22.0.3 to README release list by @mrjimenez in https://github.com/pupnp/pupnp/pull/626
Full Changelog: https://github.com/pupnp/pupnp/compare/release-22.0.3...release-22.0.4