Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55862— pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow

Quick assessment

Affected
pupnp pupnp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pupnp 是一个用于开发 UPnP 设备和控制点应用程序的软件开发工具包（SDK）。在 2.0.0 版本之前，多个 ixml DOM 遍历函数在处理深度嵌套的 XML 文档时，会执行无限制的递归操作。虽然其迭代式 XML 解析器能够接受该文档，但位于 中的 函数，以及位于 中的 、 、 和 函数，均会通过 和 指针进行递归遍历。 本地网络上的未认证对等端可通过 SOAP 请求提交深度嵌套的 XML 文档，从而耗尽服务线程的栈空间，导致 UPnP 服务崩溃。此问题属于 CVE-2021-28302 的修复不完整案例

CVSS 6.5 · Medium EPSS 0.38% · P30

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
pupnp pupnp < 2.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55862

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow
Source: CVE Program / CVE List V5
Vulnerability Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in ixml/src/node.c recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service. This is an incomplete-fix case for CVE-2021-28302 because its remediation converted ixmlNode_free but left these traversal paths recursive. This issue is fixed in 2.0.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pupnp pupnp < 2.0.0 -

II. Public POCs for CVE-2026-55862

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55862

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-55862 (1)

Vendor Advisories for CVE-2026-55862 (1)

Vendor Pages for CVE-2026-55862 (1)

Same Patch Batch · pupnp · 2026-10-16 · 5 CVEs total

CVE-2026-57487 7.5 HIGH libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
CVE-2026-57486 7.5 HIGH pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
CVE-2026-77630 7.5 HIGH pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
CVE-2026-57488 7.1 HIGH pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling

IV. Related Vulnerabilities

Same product: pupnp
Same vendor: pupnp
Same weakness: CWE-674

V. Comments for CVE-2026-55862

No comments yet

Leave a comment