The pupnp SDK contains a flaw in its parse_uri() function where the port component of a URI is converted using atoi() and then cast to a short integer, causing truncation for large port numbers. This signed/unsigned conversion error allows an attacker to supply a crafted URI that resolves to an unintended port, effectively enabling server‑side request forgery (SSRF). The vulnerability could allow the application to contact internal services or extract sensitive data that would otherwise be inaccessible, potentially compromising confidentiality or enabling further exploitation.

All releases of the pupnp SDK older than version 1.18.5 are affected. The library is used to build UPnP device and control point applications, so any product incorporating these older releases is at risk.

The CVSS score of 6.9 indicates moderate to high severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no widely publicised exploits are current. Exploitation requires that the attacker can influence the URI passed to parse_uri(), which is typically done via application input. If the SDK is used in an environment where untrusted data can be fed into it, the attacker could trigger SSRF against internal targets. The absence of a published exploit does not preclude future use, so the risk remains significant for exposed applications.