Resource exhaustion in PUPnP - #VU159572
Published: November 6, 2026
Vulnerability identifier: #VU159572
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to deny service to PUPnP devices by exhausting miniserver workers.
The vulnerability exists due to idle TCP connections occupying the miniserver's limited worker pool until the request timeout, without per-peer connection limits. An unauthenticated remote attacker can open a handful of connections to a reachable device HTTP port without sending requests and reopen them every 30 seconds to keep legitimate clients from receiving responses.
Affected software
PUPnP
Remediation
Install security update from vendor's website.
PUPnP - update to 22.1.8