Patch Forecast
Amber warning
Patch this week.

CVE-2026-57487

pupnp is an SDK for development of UPnP device and control point applications

Risk score
61/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.4%
Published
16 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in par…
Affected
Pupnp Project Pupnp before 2.0.2
Fix
Upgrade Pupnp Project Pupnp to 2.0.2 or later.
Exploitation
Public proof of concept

Story map

Story map: Pupnp Project PupnpTHE FLAWSTHE FIXCVE-2026-57487Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.5 · EPSS 0%CVE-2026-57486Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.5 · EPSS 0%CVE-2026-77630Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.5 · EPSS 0%CVE-2026-57488Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.1 · EPSS 0%Upgrade Pupnp Project Pupnp2.0.2 · 22.0.4or later on your release lineWho is exposedPupnp Project Pupnp before2.0.2AMBER · PATCH THIS WEEKPupnp ProjectPupnppupnp is an SDK for developmentof UPnP device and control pointapplications. Prior to 2.0.2,ixmlNode_compare inixml/src/node.c passes thenullable nodeValue,namespaceURI, prefix, and…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-770)202 other warnings in 30 days →Same productEarlier Pupnp Project Pupnp warnings1 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Pupnp Project Pupnp: Amber, patch this week. pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fie…

The flaws

  • CVE-2026-57487: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.5 · EPSS 0%)
  • CVE-2026-57486: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.5 · EPSS 0%)
  • CVE-2026-77630: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.5 · EPSS 0%)
  • CVE-2026-57488: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.1 · EPSS 0%)

The fix

Upgrade Pupnp Project Pupnp: 2.0.2 · 22.0.4 or later on your release line

Who is exposed: Pupnp Project Pupnp before 2.0.2

Where it stands

  • Public proof of concept

Connects to

Why it is Amber

  • CVSS 7.5 high
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in

References

Original description

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.

Last activity 16 Oct 2026. Patch Forecast updates every hour.