CVE-2021-29462 DNS rebinding in pupnp
The pupnp library is vulnerable to DNS rebinding attacks due to missing Host header validation, allowing attackers to bypass same-origin policies.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-29462?
CVE-2021-29462 is a high-severity vulnerability in pupnp, published on 20 Apr 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Portable SDK for UPnP Devices is an SDK for development of UPnP device and control point applications. The server part of pupnp (libupnp) appears to be vulnerable to DNS rebinding attacks because it does not check the value of the `Host` header. This can be mitigated by using DNS revolvers which block DNS-rebinding attacks. The vulnerability is fixed in version 1.14.6 and later.
Which versions are affected by CVE-2021-29462?
It affects 1 product.
Products include Pupnp Project Pupnp.
How do I fix CVE-2021-29462?
Upgrade to a fixed version.
Is CVE-2021-29462 being exploited?
There is no known exploitation of CVE-2021-29462 in the wild and no public exploit code.
Other vulnerabilities in pupnp
- CVE-2026-57486 pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
- CVE-2026-57487 libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
- CVE-2026-77630 pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
- CVE-2021-28302 Denial of service in n/a
- CVE-2026-57488 pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
Sources
Also known as DEBIAN-CVE-2021-29462, GHSA-6hqq-w3jq-9fhg, MGASA-2021-0319, UBUNTU-CVE-2021-29462.