{"id":"CVE-2021-28302","aliases":["DEBIAN-CVE-2021-28302","EUVD-2021-14991","GHSA-24m8-vm8v-rrfv","UBUNTU-CVE-2021-28302","openSUSE-SU-2024:11006-1"],"status":"published","title":"A stack overflow in pupnp 1.16.1 can cause the denial of service through the Parser_parseDocument...","description":"A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0115,"percentile":0.6716,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-770","CWE-776"],"published":"2021-03-12T14:32:39Z","modified":"2026-10-23T18:04:49Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"pupnp-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.4-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.6.19+git20141001-1","1:1.6.19+git20141001-1ubuntu1","1:1.6.19+git20160116-1","1:1.6.19+git20160116-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mediatomb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.1-47-g7ab7616-1ubuntu1","0.12.1-47-g7ab7616-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.6.22-1","1:1.6.24-1","1:1.6.24-2","1:1.6.24-3","1:1.6.24-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"pupnp-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.2-2","1:1.8.2-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"pupnp-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.4-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"pupnp-1.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.8.4-2ubuntu2"]}],"products":[{"vendor":"pupnp_project","product":"pupnp"}],"references":[{"url":"https://github.com/pupnp/pupnp/issues/249","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/pupnp/pupnp/releases/tag/release-1.14.5","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28302"},{"url":"https://github.com/advisories/GHSA-24m8-vm8v-rrfv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28302","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-28302","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28302","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6255","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-29462","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-28302","description":"A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.","status":"published","published":"2021-03-12T14:32:39Z","modified":"2024-08-03T21:40:13.896Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-14991","description":"A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.","status":"published","published":"2021-03-12T14:32:39Z","modified":"2024-08-03T21:40:13Z","updated_at":"2026-11-03T03:24:47.350261Z"}],"ghsa":[{"id":"GHSA-24m8-vm8v-rrfv","title":"A stack overflow in pupnp 1.16.1 can cause the denial of service through the Parser_parseDocument...","description":"A stack overflow in pupnp 1.16.1 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.","status":"published","published":"2022-05-24T17:44:31Z","modified":"2023-01-29T05:05:40Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770","CWE-776"],"updated_at":"2026-11-02T14:45:50.827495Z"}],"nvd":[{"id":"CVE-2021-28302","description":"A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.","status":"published","published":"2021-03-12T15:15:14.377Z","modified":"2026-06-17T03:46:07.883Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"CVE-2021-28302","description":"A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.","status":"published","published":"2021-03-12T15:15:14.377Z","modified":"2026-10-20T10:54:35.968260527Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28302","description":"A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.","status":"published","published":"2021-03-12T15:15:14.377Z","modified":"2026-10-23T18:04:49.694270523Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"UBUNTU-CVE-2021-28302","description":"A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.","status":"published","published":"2021-03-12T15:15:00Z","modified":"2026-04-22T12:50:39.69381Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"openSUSE-SU-2024:11006-1","title":"libixml11-1.14.10-1.2 on GA media","description":"These are all security issues fixed in the libixml11-1.14.10-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:56:18.240248Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}