TI-2026-75353 Aliases CVE-2026-57487

Chunked HTTP bodies in libupnp bypass the size limit

LOW 39CWE-770Published 2026-10-16 · Updated 2026-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

pupnp is an SDK for UPnP device and control point applications and is affected before 2.0.2. Its HTTP parser does not apply the maximum content length to decoded Transfer-Encoding: chunked bodies, so it buffers entities larger than the configured limit (CWE-770). A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can exhaust resources and cause denial of service. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0041 35th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed pupnp (pupnp): 2.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pupnp	pupnp	before 2.0.2	2.0.2	Patch available	CNA

pupnp Vendorpupnp Affected before 2.0.2 Fixed in 2.0.2 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pupnp_project:pupnp::::::::	before 2.0.2	Vulnerable	pupnp

cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:* Versions before 2.0.2 Vulnerable ·pupnp

Remediation

Update pupnp to 2.0.2, which fixes this issue. Red Hat lists one product as not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA pupnp (pupnp) Fixed in 2.0.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-16 Threatist record created from CVE-2026-57487
2026-10-18 Priority changed: MEDIUM → LOW
2026-10-21 CISA SSVC decision points changed
2026-10-21 Affected versions changed · Red Hat
2026-10-21 CVSS score added · Red Hat

References

TI-2026-75352 pupnp: NULL pointer dereference in ixmlNode_compare, non-namespaced attributes CVSS 3.1HIGH 7.5
TI-2026-75354 pupnp Content-Length integer truncation enables request smuggling CVSS 3.1HIGH 7.1
TI-2026-75349 Uncontrolled recursion in pupnp DOM functions causes stack overflow CVSS 3.1MEDIUM 6.5
TI-2021-10175 DNS rebinding in pupnp CVSS 3.1CRITICAL 9.8
TI-2026-75358 Blocking DNS lookups in pupnp allow denial of service CVSS 3.1HIGH 7.5
TI-2021-09467 A stack overflow in pupnp before version 1.14.5 can cause the denial of service through… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences