The vulnerability is an integer underflow in SOAPAction header parsing within the ParseHttpHeaders() routine of miniupnpd. When a specially crafted SOAPAction header containing a single quote is processed, the measured length underflows, yielding a large unsigned value that is used by memchr(). This causes the routine to scan far beyond the allocated HTTP request buffer, potentially leading to an out‑of‑bounds read. The resulting denial of service or accidental disclosure of memory contents demonstrates the severity of the flaw, consistent with CWE‑125 (Out‑of‑Bounds Read) and CWE‑191 (Signed/Unsigned Conversion Errors).

Products affected by this vulnerability are the miniupnp project’s miniupnpd daemon. No specific version information is provided in the CNA data, so all installed builds of miniupnpd remain potentially vulnerable until the patch is applied.

The CVSS score of 7.1 indicates a high impact, and the lack of EPSS data implies no quantifiable probability yet. Because the fault is triggered by a malformed HTTP header, an attacker only needs network access to target a running miniupnpd instance; no additional privileges are required. The flaw is not catalogued by CISA KEV at present, but the potential for remote denial of service and information disclosure warrants prompt attention.