Source: pupnp X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerabilities were published for pupnp. CVE-2026-77630[0]: | pupnp is an SDK for development of UPnP device and control point | applications. Prior to 22.0.4, parse_hostport in | upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while | parse_uri is processing attacker-supplied hostnames from inbound | HTTP request targets in upnp/src/genlib/net/http/httpparser.c and | GENA SUBSCRIBE CALLBACK headers handled by create_url_list in | upnp/src/gena/gena_device.c. A remote unauthenticated peer can | choose a slow or nonresponsive hostname and block a bounded | miniserver worker for the resolver timeout, allowing a small number | of requests to exhaust the thread pool and deny UPnP service. This | issue is fixed in 22.0.4. https://github.com/pupnp/pupnp/security/advisories/GHSA-46ph-jff5-5h77 https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2 (release-22.0.4) CVE-2026-57488[1]: | pupnp is an SDK for development of UPnP device and control point | applications. Prior to 2.0.2, raw_to_int in | upnp/src/genlib/net/http/httpparser.c parses Content-Length with | strtol and casts the resulting long to a 32-bit int before the | caller stores it as unsigned int. On LP64 systems, values greater | than INT_MAX can truncate or wrap, so the HTTP parser can accept a | body length different from the declared value. A remote adjacent- | network peer can use the resulting parser disagreement to leave | bytes to be interpreted as another request in persistent or proxied | contexts, or can make a worker wait for an extremely large body and | cause denial of service. This issue is fixed in 2.0.2. https://github.com/pupnp/pupnp/security/advisories/GHSA-g6c2-x4r9-352g https://github.com/pupnp/pupnp/commit/de9602aef34ff722f3630d66c9be8eaa0aa9f012 (release-2.0.2) CVE-2026-57487[2]: | pupnp is an SDK for development of UPnP device and control point | applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the | HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave | parser->content_length at zero while parser_parse_chunky_entity and | parser_parse_chunky_body accumulate decoded bytes in | parser->msg.entity. The g_maxContentLength checks in | http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c | therefore reject oversized numeric Content-Length bodies but do not | enforce the same limit on decoded chunked bodies. A remote peer that | can reach a SOAP, GENA, miniserver, or control-point HTTP response | path can make the process buffer an entity larger than the | configured maximum, causing resource exhaustion and denial of | service. This issue is fixed in 2.0.2. https://github.com/pupnp/pupnp/security/advisories/GHSA-gcj7-j9f7-q84c https://github.com/pupnp/pupnp/commit/9ff9bc583ad8ee4ba022634434a7b71db9bd96e1 (release-2.0.2) CVE-2026-57486[3]: | pupnp is an SDK for development of UPnP device and control point | applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c | passes the nullable nodeValue, namespaceURI, prefix, and localName | fields directly to strcmp. Non-namespaced attributes created by | ixmlDocument_createAttribute legitimately leave those fields NULL. | When ixmlElement_removeAttributeNode compares two distinct attribute | objects with the same nodeName through find_condition_node, the | pointer-identity shortcut does not apply and the comparison | dereferences NULL, causing a process crash when application handling | of attacker-controlled XML reaches this path. This issue is fixed in | 2.0.2. https://github.com/pupnp/pupnp/security/advisories/GHSA-q54q-vx78-v9rq https://github.com/pupnp/pupnp/commit/4b2f775e3b98de3cfb096707bcde040c5562d9ec (release-2.0.2) CVE-2026-55862[4]: | pupnp is an SDK for development of UPnP device and control point | applications. Prior to 2.0.0, multiple ixml DOM traversal functions | process deeply nested XML with unbounded recursion. The iterative | XML parser accepts the document, but ixmlPrintDomTreeRecursive in | ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive, | ixmlNode_getElementsByTagNameNSRecursive, | ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in | ixml/src/node.c recurse over firstChild and nextSibling links. An | unauthenticated peer on the local network can supply deeply nested | XML through a SOAP request, exhaust a service thread's stack, and | crash the UPnP service. This is an incomplete-fix case for | CVE-2021-28302 because its remediation converted ixmlNode_free but | left these traversal paths recursive. This issue is fixed in 2.0.0. https://github.com/pupnp/pupnp/security/advisories/GHSA-25cx-xv8x-j247 https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4 (release-2.0.0) If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-77630 https://www.cve.org/CVERecord?id=CVE-2026-77630 [1] https://security-tracker.debian.org/tracker/CVE-2026-57488 https://www.cve.org/CVERecord?id=CVE-2026-57488 [2] https://security-tracker.debian.org/tracker/CVE-2026-57487 https://www.cve.org/CVERecord?id=CVE-2026-57487 [3] https://security-tracker.debian.org/tracker/CVE-2026-57486 https://www.cve.org/CVERecord?id=CVE-2026-57486 [4] https://security-tracker.debian.org/tracker/CVE-2026-55862 https://www.cve.org/CVERecord?id=CVE-2026-55862 Please adjust the affected versions in the BTS as needed.
