The maintainers of jUPnP are usually only working on the main branch on code, i.e. on the next 3.x release. As the currently officially supported version is 3.x, security patches will be considered for this.

Please get in contact with the jUPnP security response team by writing a message to security@jupnp.org. Allow the team a few days time for a response. Note that everyone at jUPnP is doing all work in the spare time and not being paid - nonetheless everybody will do the best to be responsive and reliable.

Please provide your GitHub handle in the communication as if the report is accepted, the security response team will draft an advisory on GitHub and all further communication with the reporter will happen there.