pupnp has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 7.5 (high). None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-57486High· 7.5pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes53CVE-2026-57488High· 7.1pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling51CVE-2026-55862Medium· 6.5pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow48CVE-2026-77630High· 7.5pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing41CVE-2026-57487High· 7.5libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered41
pupnp vulnerabilities
CVEs affecting pupnp, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-77630High· 7.5pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames fro…
CVE-2026-57486High· 7.5PoCpupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespac…
CVE-2026-57487High· 7.5libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parse…
CVE-2026-57488High· 7.1PoCpupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the …
CVE-2026-55862Medium· 6.5PoCpupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but i…