CVE-2014-3985: Miniupnp Project Miniupnp

Medium severity, CVSS 5.0. EPSS: 3.3% chance of exploitation in the next 30 days.

The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.

Affected products

• Miniupnp Project Miniupnp: version 1.9 only
• Opensuse Opensuse: version 12.3 only; version 13.1 only

Published 2014-09-11. Last modified 2026-06-17.