Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-77630

pupnp is an SDK for development of UPnP device and control point applications

Risk score
55/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.3%
Published
16 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA S…
Affected
Pupnp Project Pupnp before 22.0.4
Fix
Upgrade Pupnp Project Pupnp to 22.0.4 or later.
Exploitation
No known exploitation

Story map

Story map: Pupnp Project PupnpTHE FLAWSTHE FIXCVE-2026-77630Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.5 · EPSS 0%CVE-2026-57486Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.5 · EPSS 0%CVE-2026-57487Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.5 · EPSS 0%CVE-2026-57488Pupnp is an SDK fordevelopment of UPnP device andcontrol point applicationsCVSS 7.1 · EPSS 0%Upgrade Pupnp Project Pupnp22.0.4 · 2.0.2or later on your release lineWho is exposedPupnp Project Pupnp before2.0.2AMBER · PATCH THIS WEEKPupnp ProjectPupnppupnp is an SDK for developmentof UPnP device and control pointapplications. Prior to 2.0.2,ixmlNode_compare inixml/src/node.c passes thenullable nodeValue,namespaceURI, prefix, and…Where it standsPublic proof of conceptCONNECTS TOSame weaknessDenial of service (CWE-400)255 other warnings in 30 days →Same productEarlier Pupnp Project Pupnp warnings1 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Pupnp Project Pupnp: Amber, patch this week. pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fie…

The flaws

  • CVE-2026-77630: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.5 · EPSS 0%)
  • CVE-2026-57486: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.5 · EPSS 0%)
  • CVE-2026-57487: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.5 · EPSS 0%)
  • CVE-2026-57488: Pupnp is an SDK for development of UPnP device and control point applications (CVSS 7.1 · EPSS 0%)

The fix

Upgrade Pupnp Project Pupnp: 22.0.4 · 2.0.2 or later on your release line

Who is exposed: Pupnp Project Pupnp before 2.0.2

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

Last activity 16 Oct 2026. Patch Forecast updates every hour.