CVE-2026-57486highCWE-476

CVE-2026-57486: fallo de gravedad alta en pupnp

pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes

Publicada el

Seguir esta CVE+ Monitorear pupnp+ Monitorear pupnp

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 0.4%
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
pupnp · pupnp
CVEs relacionadas — pupnp

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-29462HIGHDNS rebinding in pupnpEPSS 0.6%CVE-2026-55862MEDIUMpupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflowEPSS 0.5%CVE-2026-57487HIGHlibupnp chunked HTTP bodies can bypass g_maxContentLength and be fully bufferedEPSS 0.4%CVE-2026-41682MEDIUMpupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusionEPSS 0.3%CVE-2026-77630HIGHpupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsingEPSS 0.3%CVE-2026-57488HIGHpupnp: Integer truncation in HTTP Content-Length parsing enables request smugglingEPSS 0.3%