TI-2026-05017 Aliases CVE-2026-5720 GHSA-q4xv-xmjx-4h94

miniupnpd Integer Underflow SOAPAction Header Parsing

LOW 32CWE-125Published 2026-04-17 · Updated 2026-07-14

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: Low · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00674 52nd percentileScored 2026-11-07

Fix Fixed miniupnpd (miniupnp project): 2.3.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
miniupnp project	miniupnpd	before 2.3.10	2.3.10	Patch available	CNA

miniupnpd Vendorminiupnp project Affected before 2.3.10 Fixed in 2.3.10 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:miniupnp_project:miniupnpd::::::::	before 2.3.10	Vulnerable	miniupnp project

cpe:2.3:a:miniupnp_project:miniupnpd:*:*:*:*:*:*:*:* Versions before 2.3.10 Vulnerable ·miniupnp project

Remediation

Fix · CNA miniupnpd (miniupnp project) Fixed in 2.3.10

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2026-5720
2026-10-03 Alias added: GHSA-q4xv-xmjx-4h94

References

Patch 1

https://github.com/miniupnp/miniupnp/commit/f56bd09b2f2650126b832c5f30a65a09e28167fa

Other 1

https://github.com/miniupnp/miniupnp/

TI-2013-00164 Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler… CVSS 2.0HIGH 10.0
TI-2013-00163 The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd… CVSS 2.0HIGH 7.8
TI-2017-06309 Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote… CVSS 3.0CRITICAL 9.8
TI-2019-09035 A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL… CVSS 3.1HIGH 7.5
TI-2013-01269 The ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP… CVSS 2.0HIGH 7.8
TI-2019-09033 A Denial Of Service vulnerability in MiniUPnP MiniUPnPd through 2.1 exists due to a NULL… CVSS 3.0HIGH 7.5

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences