Register | Log in

miniupnpc

UPnP IGD client lightweight library client

Choose email to subscribe with

general

source: miniupnpc (main)
version: 2.3.3-2
maintainer: Thomas Goirand (DMD) (LowNMU)
uploaders: Yangfl [DMD]
arch: any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.2.1-1
oldstable: 2.2.4-1
stable: 2.2.8-2
testing: 2.3.3-2
unstable: 2.3.3-2

versioned links

2.2.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.2.4-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.2.8-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.3.3-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libminiupnpc-dev
libminiupnpc21
miniupnpc
python3-miniupnpc

action needed

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-110655: miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
CVE-2026-110656: miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.

Created: 2026-10-17 Last update: 2026-10-17 11:48

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-110655: miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
CVE-2026-110656: miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.

Created: 2026-10-17 Last update: 2026-10-17 11:48

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-110655: miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
CVE-2026-110656: miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.

Created: 2026-10-17 Last update: 2026-10-17 11:48

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-110655: miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.
CVE-2026-110656: miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.

Created: 2026-10-17 Last update: 2026-10-17 11:48

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 2.3.3-2 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-09-16 06:06

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

news

[2025-09-21] miniupnpc 2.3.3-2 MIGRATED to testing (Debian testing watch)
[2025-09-15] Accepted miniupnpc 2.3.3-2 (source) into unstable (Yangfl) (signed by: Boyuan Yang)
[2025-08-26] Accepted miniupnpc 2.3.3-1 (source amd64) into experimental (Debian FTP Masters) (signed by: Boyuan Yang)
[2024-07-26] miniupnpc 2.2.8-2 MIGRATED to testing (Debian testing watch)
[2024-07-20] Accepted miniupnpc 2.2.8-2 (source) into unstable (Yangfl) (signed by: Boyuan Yang)
[2024-07-02] Accepted miniupnpc 2.2.8-1 (source amd64) into experimental (Debian FTP Masters) (signed by: Boyuan Yang)
[2024-01-16] miniupnpc 2.2.6-1 MIGRATED to testing (Debian testing watch)
[2024-01-10] Accepted miniupnpc 2.2.6-1 (source) into unstable (Yangfl) (signed by: Boyuan Yang)
[2023-08-21] miniupnpc 2.2.5-1 MIGRATED to testing (Debian testing watch)
[2023-08-15] Accepted miniupnpc 2.2.5-1 (source) into unstable (Yangfl) (signed by: Boyuan Yang)
[2022-12-27] miniupnpc 2.2.4-1 MIGRATED to testing (Debian testing watch)
[2022-12-27] miniupnpc 2.2.4-1 MIGRATED to testing (Debian testing watch)
[2022-12-21] Accepted miniupnpc 2.2.4-1 (source) into unstable (Yangfl) (signed by: Boyuan Yang)
[2022-12-17] miniupnpc 2.2.3-2 MIGRATED to testing (Debian testing watch)
[2022-12-12] Accepted miniupnpc 2.2.3-2 (source) into unstable (Thomas Goirand)
[2021-12-21] miniupnpc 2.2.3-1 MIGRATED to testing (Debian testing watch)
[2021-12-15] Accepted miniupnpc 2.2.3-1 (source) into unstable (Yangfl) (signed by: Boyuan Yang)
[2021-01-10] miniupnpc 2.2.1-1 MIGRATED to testing (Debian testing watch)
[2021-01-04] Accepted miniupnpc 2.2.1-1 (source) into unstable (Yangfl) (signed by: Thomas Goirand)
[2020-04-30] Accepted miniupnpc 1.9.20140610-2+deb8u2 (source amd64) into oldoldstable (Thorsten Alteholz)
[2018-06-16] miniupnpc 2.1-1 MIGRATED to testing (Debian testing watch)
[2018-06-11] Accepted miniupnpc 2.1-1 (source amd64) into unstable (Yangfl) (signed by: Thomas Goirand)
[2018-05-12] miniupnpc 2.0.20180410-2 MIGRATED to testing (Debian testing watch)
[2018-05-07] Accepted miniupnpc 2.0.20180410-2 (source amd64) into unstable (Yangfl) (signed by: Thomas Goirand)
[2018-04-24] Accepted miniupnpc 2.0.20180410-1 (source amd64) into experimental, experimental (Thomas Goirand)
[2018-03-31] miniupnpc 2.0.20180222-1 MIGRATED to testing (Debian testing watch)
[2018-03-26] Accepted miniupnpc 2.0.20180222-1 (source amd64) into unstable (Thomas Goirand)
[2018-02-17] miniupnpc 2.0.20171212-3 MIGRATED to testing (Debian testing watch)
[2018-02-12] Accepted miniupnpc 2.0.20171212-3 (source amd64) into unstable (Thomas Goirand)
[2018-02-05] Accepted miniupnpc 2.0.20171212-2 (source amd64) into experimental, experimental (Thomas Goirand)

1
2

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.3.3-2build1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing