Incorrect calculation in PUPnP - #VU159576
Published: November 6, 2026
Vulnerability identifier: #VU159576
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-682
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust PUPnP miniserver workers and deny access to the device's HTTP service.
The vulnerability exists due to an incorrect receive timeout calculation in PUPnP's socket handling that converts the remaining timeout into an indefinite wait when a byte arrives just after the deadline. An unauthenticated remote attacker can hold eleven connections from two source addresses open to block legitimate requests until the connections are closed.
Affected software
PUPnP
Remediation
Install security update from vendor's website.
PUPnP - update to 22.1.9