Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.
Published: 2026-10-16
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

The vulnerability in the pupnp SDK allows a remote actor to send an HTTP response using Transfer‑Encoding: chunked that bypasses the configured maximum content length check. Because the parser treats the chunked body differently, the decoded payload can grow beyond the intended limit and is fully buffered in memory, leading to resource exhaustion and eventual denial of service.

Affected Systems

All releases of the pupnp SDK older than 2.0.2 are affected, including any applications built with pupnp that expose SOAP, GENA, miniserver, or control‑point HTTP interfaces and can be accessed by external peers.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. The EPSS score is not available, but the lack of a KEV listing suggests it has not been widely exploited yet. Attackers do not need local privileges; a remote client that can reach any UPnP HTTP endpoint can craft a chunked response to trigger the crash. Because the vulnerability leads to full memory buffering, the exploitation can be performed without complex conditions and directly leads to service disruption.

Generated by OpenCVE AI on October 16, 2026 at 17:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to pupnp release 2.0.2 or later, which includes the HTTP parsing fix.
  • If an upgraded version cannot be applied immediately, block or filter external HTTP requests that use Transfer‑Encoding: chunked to the UPnP endpoints.
  • Implement an application‑level limit on the size of decoded bodies or ensure the underlying OS limits memory usage for the process.

Generated by OpenCVE AI on October 16, 2026 at 17:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Pupnp Project
Pupnp Project pupnp
CPEs cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:*
Vendors & Products Pupnp Project
Pupnp Project pupnp

Fri, 23 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Pupnp
Pupnp pupnp
Vendors & Products Pupnp
Pupnp pupnp

Wed, 21 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.
Title libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Pupnp Pupnp
Pupnp Project Pupnp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-21T02:21:37.115Z

Reserved: 2026-06-24T14:53:40.111Z

Link: CVE-2026-57487

cve-icon Vulnrichment

Updated: 2026-10-21T02:21:32.855Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-16T16:18:44.663

Modified: 2026-10-23T16:07:21.000

Link: CVE-2026-57487

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T10:30:08Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling