{"id":"CVE-2026-55862","kind":"vulnerability","aliases":["CVE-2026-55862"],"related":[],"title":"pupnp: deeply nested XML over SOAP crashes UPnP service via stack exhaustion","description":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in ixml/src/node.c recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service. This is an incomplete-fix case for CVE-2021-28302 because its remediation converted ixmlNode_free but left these traversal paths recursive. This issue is fixed in 2.0.0.","summary":"pupnp is a C SDK for UPnP device and control point applications. Before 2.0.0, several ixml DOM traversal functions recurse without a depth limit, so a deeply nested XML document sent over SOAP can exhaust a thread's stack and crash the service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pupnp project pupnp","fixed":["2.0.0"],"affected":"< 2.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["c","embedded","iot","package","pupnp","upnp"],"not_affected_if":["no-upnp-service-exposed","pupnp-2.0.0-or-later"],"how_to_check":"- Check the pupnp version in your build or vendored copy, for example `grep -r \"UPNP_VERSION\" include/` or the package manager's installed version.\n- Look for the `ixml` DOM functions `ixmlNode_getElementsByTagNameRecursive` or `ixmlNode_cloneNodeTreeRecursive` in `ixml/src/node.c`.","fix":"- Upgrade pupnp to `2.0.0` or later.","status":"open","published_at":"2026-10-16T16:18:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:57:49+00:00","updated_at":"2026-10-25T03:57:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:57:49Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pupnp to `2.0.0` or later.","reach":"network","title":"pupnp: deeply nested XML over SOAP crashes UPnP service via stack exhaustion","impact":"low","summary":"pupnp is a C SDK for UPnP device and control point applications. Before 2.0.0, several ixml DOM traversal functions recurse without a depth limit, so a deeply nested XML document sent over SOAP can exhaust a thread's stack and crash the service.","category":"package","nicknames":[],"who_cares":["upnp","c","embedded","iot","pupnp"],"confidence":0.8,"needs_auth":"no","worst_case":"UPnP service thread crashes from stack exhaustion, causing denial of service","analyst_note":"","how_to_check":"- Check the pupnp version in your build or vendored copy, for example `grep -r \"UPNP_VERSION\" include/` or the package manager's installed version.\n- Look for the `ixml` DOM functions `ixmlNode_getElementsByTagNameRecursive` or `ixmlNode_cloneNodeTreeRecursive` in `ixml/src/node.c`.","needs_analyst":false,"not_affected_if":["pupnp-2.0.0-or-later","no-upnp-service-exposed"],"who_is_affected":"Applications built on pupnp before 2.0.0 that accept SOAP requests from the local network, such as UPnP devices and services that expose control actions. Systems that do not run a pupnp-based UPnP service, or that do not receive SOAP input from peers, are not exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3573,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2021':164C '-2026':14A,17A '-28302':165C '-55862':15A,18A '2.0.0':41B,86C,183C 'accept':103C 'applic':39B,83C 'c':22B,31B 'case':161C 'clonenodetreerecurs':116C 'control':37B,81C 'convert':169C 'crash':7A,68B,151C 'cve':13A,16A,163C 'deepli':2A,54B,93C,137C 'depth':50B 'develop':76C 'devic':35B,79C 'document':57B,105C 'dom':44B,89C 'embed':23B 'exhaust':12A,62B,144C 'firstchild':124C 'fix':160C,181C 'free':171C 'function':46B,91C 'getelementsbytagnamensrecurs':114C 'getelementsbytagnamerecurs':112C 'incomplet':159C 'incomplete-fix':158C 'iot':24B 'isancestor':119C 'issu':179C 'iter':100C 'ixml':43B,88C 'ixml/src/ixml.c':109C 'ixml/src/node.c':121C 'ixmlnod':111C,113C,115C,118C,170C 'ixmlprintdomtreerecurs':107C 'left':173C 'limit':51B 'link':127C 'local':133C 'multipl':87C 'nest':3A,55B,94C,138C 'network':134C 'nextsibl':126C 'packag':25B 'parser':102C 'path':176C 'peer':130C 'point':38B,82C 'prior':84C 'process':92C 'project':20A 'pupnp':1A,19A,21A,26B,28B,71C 'recurs':47B,98C,122C,177C 'remedi':168C 'request':143C 'sdk':32B,74C 'sent':58B 'servic':9A,70B,146C,154C 'sever':42B 'soap':6A,60B,142C 'stack':11A,66B,149C 'suppli':136C 'thread':64B,147C 'travers':45B,90C,175C 'unauthent':129C 'unbound':97C 'upnp':8A,27B,34B,78C,153C 'via':10A 'without':48B 'xml':4A,56B,95C,101C,139C","nicknames":[],"mitigations":[],"who_affected":"Applications built on pupnp before 2.0.0 that accept SOAP requests from the local network, such as UPnP devices and services that expose control actions. Systems that do not run a pupnp-based UPnP service, or that do not receive SOAP input from peers, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55862","severity":null,"published_at":"2026-10-16T16:18:44+00:00","modified_at":"2026-10-23T16:10:19+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}