Live › vulnerability › CVE-2026-57488
Go to dashboardpupnp, a C SDK for UPnP devices and control points, parses the HTTP Content-Length header with a 64-bit value cast to 32-bit int on 64-bit systems. A remote peer on the adjacent network can make the parser accept a body length different from the declared one, so leftover bytes are read as another request, or make a worker wait on a huge body and cause denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications built on pupnp that accept HTTP traffic from the network on 64-bit systems, such as UPnP devices and control points that listen for requests. Exposure depends on whether untrusted peers on the local network can reach the listening port; isolated or single-host deployments are less exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pupnp project pupnp | vendor | < 2.0.2 | 2.0.2 |
2.0.2.raw_to_int in upnp/src/genlib/net/http/httpparser.c.2.0.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-57488")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.