Source: miniupnpd Version: 2.3.10-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for miniupnpd. CVE-2026-107159[0]: | MiniUPnPd through 2.3.11 built with --strict contains a divide-by- | zero vulnerability in ProcessSSDPData() that allows unauthenticated | local network attackers to crash the daemon. Attackers can send a | single multicast M-SEARCH datagram with MX: 0 and a known ST to port | 1900, triggering SIGFPE and denying UPnP IGD service. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107159 https://www.cve.org/CVERecord?id=CVE-2026-107159 [1] https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a Please adjust the affected versions in the BTS as needed. Regards, Salvatore
