Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-57487— libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered

Quick assessment

Affected
pupnp pupnp
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pupnp 是一个用于开发 UPnP 设备和控制点应用程序的软件开发工具包（SDK）。在 2.0.2 版本之前，当请求头包含 时，位于 中的 HTTP 解析器会将 保持为零，而 和 函数却会将解码后的字节累积到 中。因此， 函数（位于 ）中的 检查仅能拒绝超出配置的超大数值型 实体，却无法对经过解码的分块（chunked）实体执行同样的限制。任何能够访问 SOAP、GENA、miniserver 或控制点 HTTP 响应路径的远程对等端，均可迫使进程缓冲超过配置最大值的实体，从而导致资源耗尽并引发拒绝服务（DoS）

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-57487

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
Source: CVE Program / CVE List V5
Vulnerability Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
pupnp pupnp < 2.0.2 -

II. Public POCs for CVE-2026-57487

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-57487

请登录查看更多情报信息。

Other References for CVE-2026-57487 (3)

Same Patch Batch · pupnp · 2026-10-16 · 5 CVEs total

CVE-2026-57486 7.5 HIGH pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
CVE-2026-77630 7.5 HIGH pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
CVE-2026-57488 7.1 HIGH pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
CVE-2026-55862 6.5 MEDIUM pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow

IV. Related Vulnerabilities

Same product: pupnp
Same vendor: pupnp
Same weakness: CWE-770

V. Comments for CVE-2026-57487

No comments yet

Leave a comment