CVE-2026-77630
7.5HighPublished 16 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-400
Impact
Remote unauthenticated attackers can cause a denial of service by exhausting the miniserver worker thread pool. They only need network access to send requests pointing to slow or nonresponsive hostnames.
Root cause
The URI parser synchronously executes getaddrinfo on attacker-controlled hostnames in HTTP targets and GENA SUBSCRIBE CALLBACK headers, blocking worker threads for the duration of the resolver timeout.
Affected systems
pupnp prior to 22.0.4
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade pupnp to version 22.0.4 or later. If patching immediately is not possible, restrict inbound network access to the UPnP service or block untrusted GENA SUBSCRIBE requests at your firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.