CVE-2026-57487
Received Received - Intake

Memory Exhaustion in Pupnp HTTP Chunked Transfer Handling

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-57487
EUVD
EUVD-2026-102929

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pupnp pupnp < 2.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in pupnp versions before 2.0.2 involves the HTTP parser not properly handling Transfer-Encoding: chunked requests. When chunked encoding is used, the parser fails to set content_length, allowing decoded entities to bypass size limits. This lets attackers send oversized chunked bodies that exceed the configured g_maxContentLength, causing resource exhaustion and denial of service.

Detection Guidance

To detect this vulnerability, monitor HTTP traffic for chunked transfer encoding requests that bypass size limits. Check if your pupnp version is below 2.0.2. Use network tools like tcpdump or Wireshark to inspect HTTP headers for Transfer-Encoding: chunked and verify if large entities are being processed despite g_maxContentLength restrictions.

Impact Analysis

This vulnerability can lead to denial of service by exhausting system resources. Attackers can remotely send specially crafted chunked HTTP requests that bypass size restrictions, causing the application to buffer excessively large data amounts. This affects embedded devices like routers, NAS devices, printers, cameras, media devices, and IoT gateways using libupnp.

Compliance Impact

This vulnerability primarily causes resource exhaustion via denial-of-service conditions, which may indirectly impact compliance by disrupting services handling sensitive data. However, there is no direct evidence that this issue leads to data breaches or unauthorized access to regulated data like GDPR or HIPAA protected information.

Mitigation Strategies

Immediately upgrade to pupnp version 2.0.2 or later to address the vulnerability. If upgrading is not possible, apply the patch from the official commit (9ff9bc583ad8ee4ba022634434a7b71db9bd96e1) to enforce size checks on decoded chunked entities. Disable or restrict access to UPnP services if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-57487. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart