CVE-2026-77630
Received Received - Intake

pupnp UPnP Service Denial of Service via Slow DNS Resolution

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-77630
EUVD
EUVD-2026-102933

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pupnp pupnp < 22.0.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77630 is a denial-of-service vulnerability in the pupnp library affecting versions prior to 22.0.4. It involves synchronous DNS resolution during URI and GENA callback parsing. Attackers can exploit this by sending crafted HTTP requests or GENA SUBSCRIBE headers with slow or nonresponsive hostnames, blocking worker threads and exhausting the thread pool.

Detection Guidance

To detect this vulnerability, check if your system is running pupnp versions prior to 22.0.4. Use commands like 'pkg-config --modversion libupnp' or 'dpkg -l | grep libupnp' to verify the installed version. Monitor network traffic for unusual delays in UPnP service responses, which may indicate thread pool exhaustion.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to disrupt UPnP service by causing denial-of-service conditions. It can block miniserver workers, exhaust thread pools, and prevent legitimate UPnP device and control point applications from functioning properly.

Compliance Impact

This vulnerability primarily impacts system availability by enabling denial-of-service attacks through thread exhaustion. It does not directly affect data confidentiality or integrity, which are key focus areas for GDPR and HIPAA. However, prolonged service disruption could indirectly impact compliance by hindering access to critical systems or data processing operations.

Mitigation Strategies

Upgrade to pupnp version 22.0.4 or later immediately. If upgrading is not possible, restrict network access to UPnP services or disable them temporarily. Ensure GENA SUBSCRIBE callback URLs use literal IP addresses instead of hostnames to prevent DNS rebinding.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77630. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart