Live › vulnerability › CVE-2026-55862
Go to dashboardpupnp is a C SDK for UPnP device and control point applications. Before 2.0.0, several ixml DOM traversal functions recurse without a depth limit, so a deeply nested XML document sent over SOAP can exhaust a thread's stack and crash the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on pupnp before 2.0.0 that accept SOAP requests from the local network, such as UPnP devices and services that expose control actions. Systems that do not run a pupnp-based UPnP service, or that do not receive SOAP input from peers, are not exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pupnp project pupnp | vendor | < 2.0.0 | 2.0.0 |
grep -r "UPNP_VERSION" include/ or the package manager's installed version.ixml DOM functions ixmlNode_getElementsByTagNameRecursive or ixmlNode_cloneNodeTreeRecursive in ixml/src/node.c.2.0.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in ixml/src/node.c recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service. This is an incomplete-fix case for CVE-2021-28302 because its remediation converted ixmlNode_free but left these traversal paths recursive. This issue is fixed in 2.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-55862")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.