{"id":"CVE-2026-57488","kind":"vulnerability","aliases":["CVE-2026-57488"],"related":[],"title":"pupnp: Content-Length truncation lets HTTP requests desync or stall","description":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.","summary":"pupnp, a C SDK for UPnP devices and control points, parses the HTTP Content-Length header with a 64-bit value cast to 32-bit int on 64-bit systems. A remote peer on the adjacent network can make the parser accept a body length different from the declared one, so leftover bytes are read as another request, or make a worker wait on a huge body and cause denial of service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pupnp project pupnp","fixed":["2.0.2"],"affected":"< 2.0.2","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["c","embedded","iot","linux","package","upnp"],"not_affected_if":["no-network-listener","version-2.0.2-or-later"],"how_to_check":"- Check the installed pupnp version; affected builds are below `2.0.2`.\n- Search your build or vendored sources for `raw_to_int` in `upnp/src/genlib/net/http/httpparser.c`.","fix":"- Upgrade pupnp to `2.0.2` or later.","status":"open","published_at":"2026-10-16T16:18:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:36:42+00:00","updated_at":"2026-10-25T03:36:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:36:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade pupnp to `2.0.2` or later.","reach":"network","title":"pupnp: Content-Length truncation lets HTTP requests desync or stall","impact":"medium","summary":"pupnp, a C SDK for UPnP devices and control points, parses the HTTP Content-Length header with a 64-bit value cast to 32-bit int on 64-bit systems. A remote peer on the adjacent network can make the parser accept a body length different from the declared one, so leftover bytes are read as another request, or make a worker wait on a huge body and cause denial of service.","category":"package","nicknames":[],"who_cares":["c","upnp","embedded","iot","linux"],"confidence":0.7,"needs_auth":"no","worst_case":"Request smuggling into proxied contexts or worker denial of service","analyst_note":"","how_to_check":"- Check the installed pupnp version; affected builds are below `2.0.2`.\n- Search your build or vendored sources for `raw_to_int` in `upnp/src/genlib/net/http/httpparser.c`.","needs_analyst":false,"not_affected_if":["version-2.0.2-or-later","no-network-listener"],"who_is_affected":"Applications built on pupnp that accept HTTP traffic from the network on 64-bit systems, such as UPnP devices and control points that listen for requests. Exposure depends on whether untrusted peers on the local network can reach the listening port; isolated or single-host deployments are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000619,"input_tokens":3480,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-57488':14A,17A '2.0.2':115C,218C '32':51B,134C '64':46B,55B 'accept':69B,162C 'adjac':63B,174C 'adjacent-network':173C 'anoth':84B,190C 'applic':112C 'bit':47B,52B,56B,135C 'bodi':71B,94B,164C,207C 'byte':80B,185C 'c':21B,29B 'caller':139C 'cast':49B,128C 'caus':96B,209C 'content':3A,41B,123C 'content-length':2A,40B,122C 'context':196C 'control':35B,110C 'cve':12A,15A 'declar':76B,169C 'denial':97B,210C 'desync':9A 'develop':105C 'devic':33B,108C 'differ':73B,166C 'disagr':182C 'embed':22B 'extrem':205C 'fix':216C 'greater':149C 'header':43B 'http':7A,39B,159C 'huge':93B 'int':53B,118C,136C,144C,151C 'interpret':188C 'iot':23B 'issu':214C 'larg':206C 'leav':184C 'leftov':79B 'length':4A,42B,72B,124C,165C 'let':6A 'linux':24B 'long':131C 'lp64':146C 'make':66B,87B,199C 'max':152C 'network':64B,175C 'one':77B 'packag':25B 'pars':37B,121C 'parser':68B,160C,181C 'peer':60B,176C 'persist':193C 'point':36B,111C 'prior':113C 'project':19A 'proxi':195C 'pupnp':1A,18A,20A,27B,100C 'raw':116C 'read':82B 'remot':59B,172C 'request':8A,85B,191C 'result':130C,180C 'sdk':30B,103C 'servic':99B,212C 'stall':11A 'store':140C 'strtol':126C 'system':57B,147C 'truncat':5A,154C 'unsign':143C 'upnp':26B,32B,107C 'upnp/src/genlib/net/http/httpparser.c':120C 'use':178C 'valu':48B,148C,170C 'wait':90B,202C 'worker':89B,201C 'wrap':156C","nicknames":[],"mitigations":[],"who_affected":"Applications built on pupnp that accept HTTP traffic from the network on 64-bit systems, such as UPnP devices and control points that listen for requests. Exposure depends on whether untrusted peers on the local network can reach the listening port; isolated or single-host deployments are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T16:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-57488","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57488","severity":null,"published_at":"2026-10-16T16:18:44+00:00","modified_at":"2026-10-20T19:37:12+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}