CVE-2026-57486High· 7.5▾ MidnightPoC availablepupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespac…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
pupnp < 2.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-57488High· 7.1pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
CVE-2026-57487High· 7.5libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
CVE-2026-55862Medium· 6.5pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow
CVE-2026-77630High· 7.5pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
CVE-2023-3338Medium· 6.5A null pointer dereference flaw was found in the Linux kernel's DECnet networking protocol
CVE-2022-47929Medium· 5.5In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "…