Download Latest Version release-22.1.8 source code.zip (1.1 MB) Google Add to Preferred Sources
Home / release-22.1.5
Name Modified Size InfoDownloads / Week
Parent folder
libupnp-22.1.5.tar.bz2 2026-09-25 788.1 kB
libupnp-22.1.5.tar.bz2.sha256 2026-09-25 89 Bytes
README.md 2026-09-25 1.1 kB
release-22.1.5 source code.tar.gz 2026-09-25 893.0 kB
release-22.1.5 source code.zip 2026-09-25 1.1 MB
Totals: 5 Items   2.8 MB 0

Security fix

  • GHSA-ggw2-jjv9-h22c: Fix SID matching for incoming GENA NOTIFY requests. The control point compared the SID header with memcmp() over the header's length, without checking it against the length of the stored SID. A SID made of the stored one, a NUL byte and padding read past the end of the stored string (CWE-125), and any prefix of the stored SID, such as uuid:, matched the subscription, so events could be injected without knowing the SID. The lengths must now be equal before the bytes are compared. Only control points are affected.

Pushed directly to main (commits b17de286, 0aa5332c, 59b6de61) ahead of this release. The advisory will be published shortly.

What's Changed

Full Changelog: https://github.com/pupnp/pupnp/compare/release-22.1.4...release-22.1.5

Source: README.md, updated 2026-09-25