CVE-2026-57487
HighCVSS 7.5Summary
In pupnp, Transfer-Encoding: chunked causes the HTTP parser to leave content_length at zero while decoded bytes accumulate in msg.entity. The g_maxContentLength checks in http_RecvMessage do not enforce the same limit on decoded chunked bodies, so a remote peer can make the process buffer an entity larger than the configured maximum. Fixed in 2.0.2.
Risk Assessment
A remote attacker able to reach SOAP, GENA, miniserver, or control-point HTTP response paths can cause resource exhaustion and denial of service.
Recommendation
Update pupnp to version 2.0.2 or later. Consider restricting network access to UPnP services as a temporary mitigation.
Other vulnerabilities in pupnp
See all- CVE-2026-77630High
In pupnp, parse_hostport synchronously calls getaddrinfo while processing attacker-supplied hostnames from inbound HTTP request targets and GENA SUBSCRIBE CALLBACK headers. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service.
- CVE-2026-57488High
In pupnp, raw_to_int in httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before storing it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser may accept a body length different from the declared value. Fixed in 2.0.2.
- CVE-2026-57486High
In pupnp, ixmlNode_compare passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp, though non-namespaced attributes legitimately leave them NULL. When ixmlElement_removeAttributeNode compares two distinct attributes with the same nodeName, the comparison dereferences NULL and crashes the process. Fixed in 2.0.2.
- CVE-2026-55862Medium
In pupnp prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service.
Original NVD description (English source)
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS