Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-55862

pupnp is an SDK for development of UPnP device and control point applications

Risk score
52/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.5%
Published
16 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecur…
Affected
Pupnp Project Pupnp before 2.0.0
Fix
Upgrade Pupnp Project Pupnp to 2.0.0 or later.
Exploitation
Public proof of concept

Story map

Story map: Pupnp Project PupnpTHE FLAWSTHE FIXCVE-2026-55862Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 6.5 · EPSS 0%CVE-2026-57486Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.5 · EPSS 0%CVE-2026-57487Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.5 · EPSS 0%CVE-2026-77630Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.5 · EPSS 0%Upgrade Pupnp Project Pupnp2.0.0 · 2.0.2 · 22.0.4or later on your release lineWho is exposedPupnp Project Pupnp before2.0.2AMBER · PATCH THIS WEEKPupnp ProjectPupnppupnp is an SDK for developmentof UPnP device and control pointapplications. Prior to 2.0.2,ixmlNode_compare inixml/src/node.c passes thenullable nodeValue,namespaceURI, prefix, and…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-674 (CWE-674)56 other warnings in 30 days →Same productEarlier Pupnp Project Pupnp warnings1 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Pupnp Project Pupnp: Amber, patch this week. pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fie…

The flaws

  • CVE-2026-55862: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 6.5 · EPSS 0%)
  • CVE-2026-57486: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.5 · EPSS 0%)
  • CVE-2026-57487: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.5 · EPSS 0%)
  • CVE-2026-77630: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.5 · EPSS 0%)

The fix

Upgrade Pupnp Project Pupnp: 2.0.0 · 2.0.2 · 22.0.4 or later on your release line

Who is exposed: Pupnp Project Pupnp before 2.0.2

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 6.5 medium
  • Public exploit or proof of concept referenced

References

Original description

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in ixml/src/node.c recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service. This is an incomplete-fix case for CVE-2021-28302 because its remediation converted ixmlNode_free but left these traversal paths recursive. This issue is fixed in 2.0.0.

Last activity 16 Oct 2026. Patch Forecast updates every hour.