CVE-2026-57488: falha de alta gravidade em pupnp
pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Produtos afetados
pupnp · pupnpCVEs relacionadas — pupnp
No mesmo produto, das mais perigosas para as menos.
CVE-2021-29462HIGHDNS rebinding in pupnpEPSS 0.6%CVE-2026-55862MEDIUMpupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflowEPSS 0.5%CVE-2026-57487HIGHlibupnp chunked HTTP bodies can bypass g_maxContentLength and be fully bufferedEPSS 0.4%CVE-2026-57486HIGHpupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributesEPSS 0.4%CVE-2026-41682MEDIUMpupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusionEPSS 0.3%CVE-2026-77630HIGHpupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsingEPSS 0.3%