Live › vulnerability › CVE-2026-77630
Go to dashboardpupnp is a C SDK for UPnP devices and control points. Before 22.0.4, attacker-supplied hostnames in inbound HTTP request targets and GENA SUBSCRIBE CALLBACK headers are resolved synchronously, so a slow hostname blocks a miniserver worker.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that embed pupnp to run a UPnP device or GENA event subscriber listen on a network-reachable port, since the flaw is triggered by inbound HTTP requests and SUBSCRIBE callback headers. Systems that only run pupnp as a client on a closed network, or that do not expose the miniserver, have less exposure. The sources do not say whether default configurations are exposed.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| pupnp project pupnp | vendor | < 22.0.4 | 22.0.4 |
pkg-config --modversion libupnp or by checking the vendored copy's version header.22.0.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-77630")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.