{"id":"CVE-2022-26505","aliases":["ALPINE-CVE-2022-26505","DEBIAN-CVE-2022-26505","DLA-2973-1","EUVD-2022-31063","GHSA-xw94-4rmp-7qw5","MGASA-2022-0391","UBUNTU-CVE-2022-26505","USN-6398-1","openSUSE-SU-2022:0079-1","openSUSE-SU-2024:11897-1"],"status":"published","title":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server...","description":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01597,"percentile":0.76074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2022-03-06T00:00:00Z","modified":"2026-11-03T08:02:57Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"minidlna","fixed_in":["1.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"minidlna","fixed_in":["1.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"minidlna","fixed_in":["1.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"minidlna","fixed_in":["1.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"minidlna","fixed_in":["1.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"minidlna","fixed_in":["1.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"minidlna","fixed_in":["1.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"minidlna","fixed_in":["1.3.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"minidlna","fixed_in":["1.3.0+dfsg-2.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"minidlna","fixed_in":["1.3.0+dfsg-2.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"minidlna","fixed_in":["1.3.0+dfsg-2.2"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"minidlna","fixed_in":["1.1.6+dfsg-1+deb9u2"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"minidlna","fixed_in":["1.3.2-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"minidlna","fixed_in":["1.1.5+dfsg-2ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"minidlna","fixed_in":["1.2.1+dfsg-1ubuntu0.18.04.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"minidlna","fixed_in":["1.2.1+dfsg-1ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"minidlna","fixed_in":["1.3.0+dfsg-2.1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"minidlna","fixed_in":["1.3.1-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"minidlna","fixed_in":["1.3.1-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"minidlna","fixed_in":["1.3.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0+dfsg-2.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0+dfsg-2.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0+dfsg-2.2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.6+dfsg-1+deb9u2"}]}],"versions":["1.1.6+dfsg-1","1.1.6+dfsg-1+deb9u1"]},{"source":"osv","ecosystem":"Mageia:8","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.2-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5+dfsg-2ubuntu0.1+esm1"}]}],"versions":["1.1.4+dfsg-4build1","1.1.5+dfsg-1","1.1.5+dfsg-2","1.1.5+dfsg-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1+dfsg-1ubuntu0.18.04.1+esm1"}]}],"versions":["1.2.0+dfsg-2","1.2.1+dfsg-1","1.2.1+dfsg-1ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1+dfsg-1ubuntu0.20.04.2"}]}],"versions":["1.2.1+dfsg-1build1","1.2.1+dfsg-1ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0+dfsg-2.1ubuntu0.1"}]}],"versions":["1.3.0+dfsg-2","1.3.0+dfsg-2.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5+dfsg-2ubuntu0.1+esm1"}]}],"versions":["1.1.4+dfsg-4build1","1.1.5+dfsg-1","1.1.5+dfsg-2","1.1.5+dfsg-2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1+dfsg-1ubuntu0.18.04.1+esm1"}]}],"versions":["1.2.0+dfsg-2","1.2.1+dfsg-1","1.2.1+dfsg-1ubuntu0.18.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1+dfsg-1ubuntu0.20.04.2"}]}],"versions":["1.2.1+dfsg-1build1","1.2.1+dfsg-1ubuntu0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0+dfsg-2.1ubuntu0.1"}]}],"versions":["1.3.0+dfsg-2","1.3.0+dfsg-2.1"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"minidlna","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"readymedia_project","product":"readymedia"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2022/03/03/1","tags":["x_transferred","Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://sourceforge.net/p/minidlna/git/ci/c21208508dbc131712281ec5340687e5ae89e940/","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2022/03/06/1","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/04/msg00005.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202311-12","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-26505"},{"url":"https://github.com/advisories/GHSA-xw94-4rmp-7qw5"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-26505","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-26505","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0391.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30115","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2022/03/06/1","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VXEFRXJEYR7QPAMYNWTJIYKTVX5OEQ7O/","tags":["web","advisory"]},{"url":"https://www.debian.org/lts/security/2022/dla-2973","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-26505","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6398-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-26505","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-33476","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1196814","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-26505","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-26505","description":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.","status":"published","published":"2022-03-06T00:00:00Z","modified":"2024-08-03T05:03:32.899Z","updated_at":"2026-11-02T14:34:25.954329Z"}],"euvd":[{"id":"EUVD-2022-31063","description":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.","status":"published","published":"2022-03-06T00:00:00Z","modified":"2024-08-03T05:03:32Z","updated_at":"2026-11-03T03:25:44.694159Z"}],"ghsa":[{"id":"GHSA-xw94-4rmp-7qw5","title":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server...","description":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.","status":"published","published":"2022-03-07T00:00:40Z","modified":"2023-11-25T12:30:18Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:55:06.358976Z"}],"nvd":[{"id":"CVE-2022-26505","description":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.","status":"published","published":"2022-03-06T07:15:07.357Z","modified":"2026-06-17T04:35:19.12Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:07:12.711288Z"}],"osv":[{"id":"ALPINE-CVE-2022-26505","description":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.","status":"published","published":"2022-03-06T07:15:07.357Z","modified":"2026-11-03T07:31:23.264161692Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:50:01.054176Z"},{"id":"CVE-2022-26505","description":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.","status":"published","published":"2022-03-06T07:15:07.357Z","modified":"2026-04-16T04:32:48.859113886Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:24.758293Z"},{"id":"DEBIAN-CVE-2022-26505","description":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.","status":"published","published":"2022-03-06T07:15:07.357Z","modified":"2026-11-03T08:02:57.716669543Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"UBUNTU-CVE-2022-26505","description":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files.","status":"published","published":"2022-03-06T07:15:00Z","modified":"2026-02-04T02:49:48.149198Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:53.13624Z"},{"id":"DLA-2973-1","title":"minidlna - security update","status":"published","published":"2022-04-10T00:00:00Z","modified":"2026-03-09T01:21:34.212598Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0391","title":"Updated minidlna packages fix security vulnerability","description":"A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1\nallows a remote web server to exfiltrate media files. (CVE-2022-26505)\n","status":"published","published":"2022-10-28T06:54:08Z","modified":"2026-04-16T04:40:35.018879385Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2022:0079-1","title":"Security update for minidlna","description":"This update for minidlna fixes the following issues:\n\nminidlna was updated to version 1.3.1 (boo#1196814)\n\n- Fixed a potential crash in SSDP request parsing.\n- Fixed a configure script failure on some platforms.\n- Protect against DNS rebinding attacks. (CVE-2022-26505)\n- Fix an socket leakage issue on some platforms.\n- Minor bug fixes.\n\n- add 'su minidlna minidlna' to the logrotate config\n- Added hardening to systemd service(s) (boo#1181400).\n- Use sysusers macros to create minidlna user\n- Don't hardrequire logrotate, we don't write log files anymore\n","status":"published","published":"2022-03-10T23:02:00Z","modified":"2026-02-04T02:38:43.871896Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11897-1","title":"minidlna-1.3.1-1.1 on GA media","description":"These are all security issues fixed in the minidlna-1.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:59.797744Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"USN-6398-1","title":"minidlna vulnerabilities","description":"It was discovered that ReadyMedia was vulnerable to DNS rebinding attacks.\nA remote attacker could possibly use this issue to trick the local DLNA\nserver to leak information. This issue only affected Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-26505)\n\nIt was discovered that ReadyMedia incorrectly handled certain HTTP requests\nusing chunked transport encoding. A remote attacker could possibly use this\nissue to cause buffer overflows, resulting in out-of-bounds reads and writes.\n(CVE-2023-33476)\n","status":"published","published":"2023-09-27T09:39:41Z","modified":"2026-06-25T13:32:21.983559208Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}