SB2026110643 - Multiple vulnerabilities in PUPnP

Description

This security bulletin contains information about 3 vulnerabilities.

1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to read files outside the configured document root.

The vulnerability exists due to incomplete path normalization in PUPnP's built-in web server on Windows when an application configures a document root, allowing encoded backslashes to bypass traversal checks. An unauthenticated remote attacker can send an HTTP request containing /..%5csecret.txt to the reachable server to retrieve files outside that root that the server process can read.

2) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to deny service to PUPnP devices by exhausting miniserver workers.

The vulnerability exists due to idle TCP connections occupying the miniserver's limited worker pool until the request timeout, without per-peer connection limits. An unauthenticated remote attacker can open a handful of connections to a reachable device HTTP port without sending requests and reopen them every 30 seconds to keep legitimate clients from receiving responses.

3) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated adjacent-network attacker to exhaust memory and cause denial of service in PUPnP applications that register a root device.

The vulnerability exists due to missing upper limits on the MX header in SSDP M-SEARCH handling, allowing excessive reply delays that retain allocated memory. An unauthenticated adjacent-network attacker can repeatedly send requests with very large MX values to UDP port 1900, accumulating pending replies until device memory is exhausted.

Remediation

Install update from vendor's website.

References

• https://github.com/pupnp/pupnp/security/advisories/GHSA-f8rh-7wq7-v4m7
• https://github.com/pupnp/pupnp/security/advisories/GHSA-hwrm-c56x-fj22
• https://github.com/pupnp/pupnp/security/advisories/GHSA-8pj8-vmhq-qwvj