Download Latest Version release-22.0.4 source code.zip (1.1 MB)
Email in envelope

Get an email when there's a new version of Portable UPnP SDK

Home / release-22.0.4
Name Modified Size InfoDownloads / Week
Parent folder
libupnp-22.0.4.tar.bz2 2026-07-15 772.7 kB
libupnp-22.0.4.tar.bz2.sha256 2026-07-15 89 Bytes
README.md 2026-07-15 1.5 kB
release-22.0.4 source code.tar.gz 2026-07-15 874.4 kB
release-22.0.4 source code.zip 2026-07-15 1.1 MB
Totals: 5 Items   2.7 MB 12

Security fix

  • OSS-Fuzz 531780528: Stop resolving DNS during URI/GENA callback parsing. parse_hostport() called getaddrinfo() synchronously on any non-literal-IP host, and parse_uri() runs directly on untrusted input in two places: the HTTP request-line parser (embedded miniserver) and GENA SUBSCRIBE callback-URL parsing. A remote, unauthenticated peer could block a worker thread on DNS resolution (CWE-400). parse_uri()/parse_hostport() no longer perform DNS resolution; the new resolve_hostport() defers it to legitimate outbound-connection points. GENA SUBSCRIBE callback URLs now require a literal IP outright, closing a DNS-rebinding gap in the CVE-2020-12695 (CallStranger) same-subnet check as well.

Pushed directly to main (commits 5dba8070, 8b016a29, 0a03336b) ahead of this release. A GHSA advisory will follow.

What's Changed

Full Changelog: https://github.com/pupnp/pupnp/compare/release-22.0.3...release-22.0.4

Source: README.md, updated 2026-07-15