{"id":"CVE-2021-33516","aliases":["ALSA-2021:2363","CLSA-2026-1791546292","DEBIAN-CVE-2021-33516","EUVD-2021-20208","GHSA-mqgp-2h56-fx4q","MGASA-2021-0321","OESA-2021-1272","RHSA-2021:2363","RHSA-2021:2417","RHSA-2021:2422","RHSA-2021:2459","RLSA-2021:2363","SUSE-SU-2021:2080-1","SUSE-SU-2021:2153-1","UBUNTU-CVE-2021-33516","USN-4970-1","openSUSE-SU-2021:0917-1","openSUSE-SU-2021:2153-1","openSUSE-SU-2024:10837-1"],"status":"published","title":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS...","description":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01084,"percentile":0.65658,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2021-05-24T14:53:02Z","modified":"2026-10-29T11:00:58Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"gupnp","fixed_in":["1.0.6-2.el8_4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"gupnp-devel","fixed_in":["1.0.6-2.el8_4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"gir1.2-gupnp-1.0","fixed_in":["1.0.2-2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgupnp-1.0-4","fixed_in":["1.0.2-2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgupnp-1.0-dev","fixed_in":["1.0.2-2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libgupnp-doc","fixed_in":["1.0.2-2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"gupnp","fixed_in":["1.4.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gupnp","fixed_in":["1.4.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gupnp","fixed_in":["1.4.0-2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"gupnp","fixed_in":["1.2.3-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"gupnp","fixed_in":["1.2.4-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"gupnp","fixed_in":["1.2.4-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"gupnp","fixed_in":["1.2.4-1.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gupnp","fixed_in":["0:1.0.6-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gupnp-debuginfo","fixed_in":["0:1.0.6-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gupnp-debugsource","fixed_in":["0:1.0.6-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gupnp-debuginfo","fixed_in":["0:1.0.6-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gupnp-debugsource","fixed_in":["0:1.0.6-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gupnp-devel","fixed_in":["0:1.0.6-2.el8_4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gupnp","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gupnp-debuginfo","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gupnp-devel","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"gupnp-docs","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gupnp-debuginfo","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gupnp-devel","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gupnp-docs","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gupnp","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gupnp-debuginfo","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gupnp-devel","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"gupnp-docs","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gupnp","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gupnp-debuginfo","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gupnp-devel","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gupnp-docs","fixed_in":["0:1.0.2-6.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"gupnp","fixed_in":["0:1.0.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"gupnp-debuginfo","fixed_in":["0:1.0.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"gupnp-debugsource","fixed_in":["0:1.0.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::crb","package":"gupnp-debuginfo","fixed_in":["0:1.0.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::crb","package":"gupnp-debugsource","fixed_in":["0:1.0.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::crb","package":"gupnp-devel","fixed_in":["0:1.0.3-3.el8_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gupnp","fixed_in":["0:1.0.3-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gupnp-debuginfo","fixed_in":["0:1.0.3-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gupnp-debugsource","fixed_in":["0:1.0.3-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"gupnp-debuginfo","fixed_in":["0:1.0.3-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"gupnp-debugsource","fixed_in":["0:1.0.3-3.el8_1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"gupnp-devel","fixed_in":["0:1.0.3-3.el8_1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"gupnp","fixed_in":["0:1.0.6-2.el8_4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gupnp","fixed_in":["0.20.18-8.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"gupnp","fixed_in":["0.20.18-8.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"gupnp","fixed_in":["1.2.2-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"gupnp","fixed_in":["1.2.2-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"gupnp","fixed_in":["1.2.2-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"gupnp","fixed_in":["1.2.2-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"gupnp","fixed_in":["1.2.2-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"gupnp","fixed_in":["1.2.2-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"gupnp","fixed_in":["1.2.3-0ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"gupnp","fixed_in":["1.2.2-lp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"gupnp","fixed_in":["1.2.2-3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-2.el8_4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"gupnp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-2.el8_4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"gir1.2-gupnp-1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgupnp-1.0-4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgupnp-1.0-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgupnp-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-2"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4-1.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gupnp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"gupnp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gupnp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gupnp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"gupnp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-2.el8_4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gupnp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gupnp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"gupnp-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gupnp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gupnp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"gupnp-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gupnp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gupnp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"gupnp-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gupnp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gupnp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"gupnp-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.2-6.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"gupnp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"gupnp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::crb","package":"gupnp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::crb","package":"gupnp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::crb","package":"gupnp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gupnp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"gupnp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"gupnp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"gupnp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::crb","package":"gupnp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.3-3.el8_1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.6-2.el8_4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.18-8.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.18-8.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP2","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP2","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP2","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP3","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.20.14-1","0.20.15-1","0.20.15-1ubuntu1","0.20.16-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-1","1.0.2-1","1.0.2-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-0ubuntu0.20.04.2"}]}],"versions":["1.2.1-1","1.2.1-2","1.2.2-1","1.2.3-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3-0ubuntu0.20.04.2"}]}],"versions":["1.2.1-1","1.2.1-2","1.2.2-1","1.2.3-0ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-lp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gupnp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-2.2"}]}],"bundled":2}],"products":[{"vendor":"gnome","product":"gupnp"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/gupnp/-/issues/24","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report","article"]},{"url":"https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33516","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mqgp-2h56-fx4q"},{"url":"https://errata.almalinux.org/8/ALSA-2021-2363.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-33516","tags":["report"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1791546292.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-33516","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0321.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29085","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4970-1","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2363","tags":["web","advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1272","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964091","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2363.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33516","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33516","tags":["advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/gupnp/-/commit/05e964d48322ff23a65c6026d656e4494ace6ff9.","tags":["article"]},{"url":"https://gitlab.gnome.org/GNOME/gupnp/-/commit/ca6ec9dcb26fd7a2a630eb6a68118659b589afac","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2417","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2417.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2422","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2422.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2459","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2459.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:2363","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212080-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186590","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33516","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212153-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-33516","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VQTLJKRQND7UED3XI3J3HC6A2XVGYC7H/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CWMAQ7IJUIENIJYPPEUVGYSZ473DP5EV/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12695","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-33516","description":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.","status":"published","published":"2021-05-24T14:53:02Z","modified":"2024-08-03T23:50:43.022Z","updated_at":"2026-11-02T14:33:10.204494Z"}],"euvd":[{"id":"EUVD-2021-20208","description":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.","status":"published","published":"2021-05-24T14:53:02Z","modified":"2024-08-03T23:50:43Z","updated_at":"2026-11-03T03:24:34.304953Z"}],"ghsa":[{"id":"GHSA-mqgp-2h56-fx4q","title":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS...","description":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.","status":"published","published":"2022-05-24T19:03:02Z","modified":"2023-01-29T05:06:46Z","updated_at":"2026-11-02T14:46:05.929333Z"}],"nvd":[{"id":"CVE-2021-33516","description":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.","status":"published","published":"2021-05-24T15:15:07.4Z","modified":"2026-06-17T03:54:42.873Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"CVE-2021-33516","description":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.","status":"published","published":"2021-05-24T15:15:07.4Z","modified":"2026-10-24T10:50:12.624018128Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:20.13324Z"},{"id":"DEBIAN-CVE-2021-33516","description":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.","status":"published","published":"2021-05-24T15:15:07.4Z","modified":"2026-10-23T18:03:49.319271242Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2021-1272","title":"gupnp security update","description":"GUPnP is an elegant, object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible. It provides the same set of features as libupnp,but shields the developer from most of UPnP\u0026apos;s internals.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim\u0026apos;s browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.(CVE-2021-33516)","status":"published","published":"2021-07-24T11:04:30Z","modified":"2026-08-18T01:15:50.626374448Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:2363","title":"Red Hat Security Advisory: gupnp security update","status":"published","published":"2024-09-16T06:03:36Z","modified":"2026-06-26T12:21:58.924963274Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:2417","title":"Red Hat Security Advisory: gupnp security update","status":"published","published":"2024-09-16T06:03:45Z","modified":"2026-06-26T12:22:28.296548237Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:2422","title":"Red Hat Security Advisory: gupnp security update","status":"published","published":"2024-09-16T06:03:52Z","modified":"2026-06-26T12:21:58.942132748Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:2459","title":"Red Hat Security Advisory: gupnp security update","status":"published","published":"2024-09-16T06:03:58Z","modified":"2026-06-26T12:21:58.925477967Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:2363","title":"Important: gupnp security update","description":"GUPnP is an object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible.\n\nSecurity Fix(es):\n\n* gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services (CVE-2021-33516)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-06-09T12:54:08Z","modified":"2026-02-05T14:45:03.981826Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-33516","description":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5. It allows DNS rebinding. A remote web server can exploit this vulnerability to trick a victim's browser into triggering actions against local UPnP services implemented using this library. Depending on the affected service, this could be used for data exfiltration, data tempering, etc.","status":"published","published":"2021-05-24T15:15:00Z","modified":"2026-04-22T12:54:42.65403Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"ALSA-2021:2363","title":"Important: gupnp security update","description":"GUPnP is an object-oriented open source framework for creating UPnP devices and control points, written in C using GObject and libsoup. The GUPnP API is intended to be easy to use, efficient and flexible.\n\nSecurity Fix(es):\n\n* gupnp: allows DNS rebinding which could result in tricking browser into triggering actions against local UPnP services (CVE-2021-33516)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-06-09T12:54:08Z","modified":"2026-10-29T11:00:58.817168817Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2026-1791546292","title":"Fix CVE(s): CVE-2021-33516","description":"   * CVE-2021-33516: DNS rebinding in control_server_handler()","status":"published","published":"2026-10-09T11:45:03Z","modified":"2026-10-26T09:32:04.774452259Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"MGASA-2021-0321","title":"Updated gupnp packages fix a security vulnerability","description":"An issue was discovered in GUPnP before 1.0.7 and 1.1.x and 1.2.x before 1.2.5.\nIt allows DNS rebinding. A remote web server can exploit this vulnerability to\ntrick a victim's browser into triggering actions against local UPnP services\nimplemented using this library. Depending on the affected service, this could\nbe used for data exfiltration, data tempering, etc. (CVE-2021-33516)\n","status":"published","published":"2021-07-08T22:43:19Z","modified":"2026-04-16T04:41:46.920737768Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0917-1","title":"Security update for gupnp","description":"This update for gupnp fixes the following issues:\n\n- CVE-2021-33516: Fixed a DNS rebinding, which could trick the browser into triggering actions against local UPnP services (bsc#1186590).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-06-25T04:52:58Z","modified":"2026-02-04T02:30:59.675038Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2153-1","title":"Security update for gupnp","description":"This update for gupnp fixes the following issues:\n\n- CVE-2021-33516: Fixed a DNS rebinding, which could trick the browser into triggering actions against local UPnP services (bsc#1186590).\n","status":"published","published":"2021-07-11T08:05:56Z","modified":"2026-02-04T02:44:48.305443Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10837-1","title":"libgupnp-1_2-0-1.2.7-2.2 on GA media","description":"These are all security issues fixed in the libgupnp-1_2-0-1.2.7-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:21:13.665232Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2021:2080-1","title":"Security update for gupnp","description":"This update for gupnp fixes the following issues:\n\n- CVE-2021-33516: Fixed a DNS rebinding, which could trick the browser into triggering actions against local UPnP services (bsc#1186590).\n","status":"published","published":"2021-06-18T13:10:18Z","modified":"2026-02-04T04:32:16.195817Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2153-1","title":"Security update for gupnp","description":"This update for gupnp fixes the following issues:\n\n- CVE-2021-33516: Fixed a DNS rebinding, which could trick the browser into triggering actions against local UPnP services (bsc#1186590).\n","status":"published","published":"2021-06-24T09:00:40Z","modified":"2026-02-04T02:24:35.726169Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4970-1","title":"gupnp vulnerability","description":"It was discovered that GUPnP incorrectly filtered local requests. If a user\nwere tricked into visiting a malicious website, a remote attacker could\npossibly use this issue to perform actions against local UPnP services such\nas obtaining or altering sensitive information.\n","status":"published","published":"2021-06-01T11:20:45Z","modified":"2026-04-27T15:54:37.672644Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}