CVE-2026-5720
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
An integer underflow vulnerability in miniupnpd's SOAPAction header parsing allows remote attackers to cause denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Improper length validation leads to an out-of-bounds memory read.
Risk Assessment
The organization faces denial of service attacks and potential leakage of sensitive data from the miniupnpd process memory, which can disrupt network services and compromise information confidentiality.
Recommendation
Update miniupnpd to a patched version immediately. If unavailable, restrict access to the service to trusted networks only.
Other vulnerabilities in miniupnpd
See all- CVE-2026-107159Medium
MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.
- CVE-2026-10069High
A vulnerability in Shibby Tomato 1.28 was found in an unknown function of the file usr/sbin/miniupnpd, leading to resource exhaustion. The attack can be launched remotely. This product is no longer supported by the maintainer.
- CVE-2026-10068High
In Shibby Tomato 1.28, the SUBSCRIBE Call Handler component's send function in usr/sbin/miniupnpd allows a Server-Side Request Forgery (SSRF) attack. The vulnerability can be exploited remotely. The project is superseded by FreshTomato and is no longer supported.
Original NVD description (English source)
miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS