SB2026092472 - Multiple vulnerabilities in PUPnP

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092472

SB2026092472 - Multiple vulnerabilities in PUPnP

Published: September 24, 2026

Security Bulletin ID SB2026092472
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in gena_subscribe() when processing a granted TIMEOUT: Second-0 subscription response. A remote attacker can operate a rogue UPnP device that grants a zero-second subscription timeout to cause a denial of service.

Exploitation requires the application to discover the attacker's device on the local network.


2) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in the HTTP chunked transfer encoding parser when parsing chunked HTTP messages with endless trailer headers or an unterminated chunk-size line. A remote attacker can send a crafted chunked HTTP message to exhaust process memory and cause a denial of service.

Device hosts and control points processing received responses and NOTIFY requests are affected.


3) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits in the streaming HTTP GET client when processing HTTP response status lines and headers. A remote attacker can send an unbounded stream of header lines without a terminating blank line to cause a denial of service.

The issue affects UpnpOpenHttpGet(), UpnpOpenHttpGetProxy(), UpnpOpenHttpGetEx(), and UpnpGetHttpResponse().


Remediation

Install update from vendor's website.

References