Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.
Published: 2026-10-16
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

The vulnerability lies in pupnp’s URI parsing functionality where the synchronous getaddrinfo call is invoked during HTTP request processing, allowing a remote attacker to supply a hostname that resolves slowly or fails, which blocks a miniserver worker thread for the resolver timeout. This results in denial of service on the UPnP service by exhausting the limited thread pool. The weakness is classified as CWE-400, Uncontrolled Resource Consumption.

Affected Systems

Devices and control points built with the pupnp SDK prior to release 22.0.4 are affected. This includes all versions of pupnp distributed by the vendor pupnp. The issue was resolved in version 22.0.4, so any deployments using an earlier release should be updated accordingly.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity, though EPSS data is not currently available and the vulnerability is not listed in CISA’s KEV catalog. An unauthenticated remote user can trigger the denial of service by sending HTTP requests that include the problematic hostnames, utilizing the existing UPnP interfaces. No special credentials are required; the exploit relies on normal operation of the SDK to resolve external hostnames.

Generated by OpenCVE AI on October 16, 2026 at 18:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the pupnp SDK to version 22.0.4 or newer, which contains the fix that removes the blocking DNS resolution during parsing.
  • If an upgrade cannot be applied immediately, restrict incoming HTTP requests to the UPnP service by using firewall rules or network segmentation, ensuring that only trusted hosts can access the endpoint that triggers the URI parsing.
  • As a temporary measure, configure the application to use asynchronous DNS resolution or to reject hostnames that do not resolve within a short timeout, thereby preventing the miniserver thread from being blocked.
  • Implement additional rate limiting on the miniserver thread pool to mitigate the impact of rapid repeated requests from malicious actors.

Generated by OpenCVE AI on October 16, 2026 at 18:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Pupnp Project
Pupnp Project pupnp
CPEs cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:*
Vendors & Products Pupnp Project
Pupnp Project pupnp

Sun, 18 Oct 2026 05:30:00 +0000

Type Values Removed Values Added
First Time appeared Pupnp
Pupnp pupnp
Vendors & Products Pupnp
Pupnp pupnp

Fri, 16 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.
Title pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Pupnp Pupnp
Pupnp Project Pupnp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-16T17:06:16.423Z

Reserved: 2026-08-20T20:52:01.927Z

Link: CVE-2026-77630

cve-icon Vulnrichment

Updated: 2026-10-16T16:46:59.445Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-16T16:21:03.187

Modified: 2026-10-20T19:36:35.460

Link: CVE-2026-77630

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T05:15:05Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption