Allocation of Resources Without Limits or Throttling in PUPnP - #VU151944
Published: September 24, 2026
Vulnerability identifier: #VU151944
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits in the HTTP chunked transfer encoding parser when parsing chunked HTTP messages with endless trailer headers or an unterminated chunk-size line. A remote attacker can send a crafted chunked HTTP message to exhaust process memory and cause a denial of service.
Device hosts and control points processing received responses and NOTIFY requests are affected.
Affected software
PUPnP
Remediation
Install security update from vendor's website.
PUPnP - update to 22.1.3