CVE-2026-57488
7.1HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-190, CWE-444
Impact
Adjacent network attackers can cause denial of service or smuggle HTTP requests against persistent or proxied connections without credentials. Exploitation requires sending requests with oversized Content-Length headers over the local network segment.
Root cause
The HTTP parser uses strtol on LP64 systems and casts the resulting long to a 32-bit signed int, causing integer truncation when Content-Length exceeds INT_MAX.
Affected systems
pupnp versions prior to 2.0.2 on LP64 systems
CVSS v3.1 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Fix & remediation
Upgrade pupnp to version 2.0.2 or later. If updating is delayed, restrict adjacent network access to UPnP service ports or disable persistent HTTP connections.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.