The vulnerability arises from unbounded recursion in several ixml DOM traversal functions, including ixmlPrintDomTreeRecursive, ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor. An attacker on the local network can send a SOAP request containing a deeply nested XML document. The recursive calls exhaust the service thread’s stack, causing the UPnP service to crash. This results in a denial‑of‑service condition while not granting additional authentication or data exposure, as the exploit requires unauthenticated local access.

pupnp SDK versions released before 2.0.0. The issue is present in all builds that include the ixml library functions listed above.

The published CVSS score of 6.5 indicates a medium severity risk. No EPSS data is available and the vulnerability is not catalogued in the CISA KEV list. The attack vector is local network, unauthenticated; the attacker only needs the ability to send a SOAP request to the UPnP service. Since the vulnerability is a stack exhaustion, once triggered it leads to a service crash and possible brief denial of service, but it does not allow further compromise or remote code execution.