---
id: "CVE-2026-55862"
kind: "vulnerability"
aliases: ["CVE-2026-55862"]
title: "pupnp: deeply nested XML over SOAP crashes UPnP service via stack exhaustion"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "pupnp project pupnp", "fixed": ["2.0.0"], "affected": "< 2.0.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["c", "embedded", "iot", "package", "pupnp", "upnp"]
not_affected_if: ["no-upnp-service-exposed", "pupnp-2.0.0-or-later"]
published_at: "2026-10-16T16:18:44+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T03:57:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55862", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# pupnp: deeply nested XML over SOAP crashes UPnP service via stack exhaustion

pupnp is a C SDK for UPnP device and control point applications. Before 2.0.0, several ixml DOM traversal functions recurse without a depth limit, so a deeply nested XML document sent over SOAP can exhaust a thread's stack and crash the service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:pupnp project pupnp affected < 2.0.0 fixed 2.0.0

## How to check

- Check the pupnp version in your build or vendored copy, for example `grep -r "UPNP_VERSION" include/` or the package manager's installed version.
- Look for the `ixml` DOM functions `ixmlNode_getElementsByTagNameRecursive` or `ixmlNode_cloneNodeTreeRecursive` in `ixml/src/node.c`.

## Fix

- Upgrade pupnp to `2.0.0` or later.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55862

## From the sources

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in ixml/src/node.c recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service. This is an incomplete-fix case for CVE-2021-28302 because its remediation converted ixmlNode_free but left these traversal paths recursive. This issue is fixed in 2.0.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_