CVE-2026-57487highCWE-770

CVE-2026-57487: falha de alta gravidade em pupnp

libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pupnp+ Monitorar pupnp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.4%
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
pupnp · pupnp
CVEs relacionadas — pupnp

No mesmo produto, das mais perigosas para as menos.

CVE-2021-29462HIGHDNS rebinding in pupnpEPSS 0.6%CVE-2026-55862MEDIUMpupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflowEPSS 0.5%CVE-2026-57486HIGHpupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributesEPSS 0.4%CVE-2026-41682MEDIUMpupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusionEPSS 0.3%CVE-2026-77630HIGHpupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsingEPSS 0.3%CVE-2026-57488HIGHpupnp: Integer truncation in HTTP Content-Length parsing enables request smugglingEPSS 0.3%