Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.
Published: 2026-10-16
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Request smuggling and potential denial of service via truncated Content‑Length parsing
Action: Patch Now
AI Analysis

Impact

A 64‑bit to 32‑bit integer truncation occurs in the HTTP parser of pupnp, allowing a crafted Content‑Length header to overflow and be interpreted as a smaller value once stored as an unsigned int. This discrepancy can cause the server to accept a different body length than declared, leading to request smuggling or a long wait for a body that never arrives, thereby enabling denial of service. The weakness is represented by CWE‑190 and CWE‑444.

Affected Systems

The issue affects the pupnp SDK used for developing UPnP device and control point applications. All versions before release 2.0.2 on LP64 systems are vulnerable, regardless of the operating system or underlying hardware.

Risk and Exploitability

With a CVSS score of 7.1 the vulnerability is considered high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. A remote adjacent‑network peer can send a request that exploits the parser inconsistency, either smuggling a subsequent request in a persistent or proxied context or exhausting resources by requesting an extremely large body.

Generated by OpenCVE AI on October 16, 2026 at 17:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade pupnp to version 2.0.2 or later, which corrects the integer conversion and bounds check.
  • If an upgrade is impossible, configure the HTTP server layer to reject any Content‑Length values that exceed the maximum 32‑bit signed integer before passing them to pupnp's parser.
  • Apply stricter input validation for Content‑Length headers in the application layer, ensuring the value is parsed using a safe routine that guards against overflow and tristate issues.

Generated by OpenCVE AI on October 16, 2026 at 17:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Pupnp
Pupnp pupnp
Vendors & Products Pupnp
Pupnp pupnp

Tue, 20 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Pupnp Project
Pupnp Project pupnp
CPEs cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:*
Vendors & Products Pupnp Project
Pupnp Project pupnp

Fri, 16 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.
Title pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
Weaknesses CWE-190
CWE-444
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

Subscriptions

Pupnp Pupnp
Pupnp Project Pupnp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-16T19:08:25.462Z

Reserved: 2026-06-24T14:53:40.111Z

Link: CVE-2026-57488

cve-icon Vulnrichment

Updated: 2026-10-16T19:08:18.492Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-16T16:18:44.823

Modified: 2026-10-20T19:37:12.947

Link: CVE-2026-57488

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T14:15:06Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound

  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')