CVE-2026-57487
7.5HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-770
Impact
Remote, unauthenticated attackers can crash or exhaust the memory of services using pupnp by sending oversized chunked HTTP payloads. Any reachable SOAP, GENA, miniserver, or control-point HTTP response endpoint is exposed.
Root cause
The HTTP parser handles chunked transfer encoding without enforcing the configured g_maxContentLength check, leaving the recorded content length at zero while accumulating decoded bytes directly into memory.
Affected systems
pupnp prior to version 2.0.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade pupnp to version 2.0.2 or later. If updating immediately is not possible, restrict network access to exposed UPnP/SOAP/GENA endpoints at the firewall or reverse proxy level.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.