CVE-2026-55862
- Source
- https://cve.org/CVERecord?id=CVE-2026-55862
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55862.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-55862
- Aliases
-
- GHSA-25cx-xv8x-j247
- Downstream
- Published
- 2026-10-16T15:32:08Z
- Modified
- 2026-10-28T11:15:07Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow
- Details
-
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in ixml/src/node.c recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service. This is an incomplete-fix case for CVE-2021-28302 because its remediation converted ixmlNode_free but left these traversal paths recursive. This issue is fixed in 2.0.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-674" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55862.json" }- References
-
- https://github.com/pupnp/pupnp/releases/tag/release-2.0.0
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55862.json
- https://github.com/pupnp/pupnp/security/advisories/GHSA-25cx-xv8x-j247
- https://nvd.nist.gov/vuln/detail/CVE-2026-55862
- https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4
Affected packages
Git / github.com/pupnp/pupnp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/pupnp/pupnp
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0" }, { "fixed": "2.0.0" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "82ccaec7ab6b1258ea1ac66374d8940712ccd4c4" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "release-2.0.0", "range": [ { "fixed": "2719398035952dadb8e2970d27573707c28ba956" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
Other
last_svn_trunk
release-1.*
release-1.10.0
release-1.10.1
release-1.12.0
release-1.14.0
release-1.14.1
release-1.14.10
release-1.14.11
release-1.14.12
release-1.14.13
release-1.14.14
release-1.14.15
release-1.14.16
release-1.14.17
release-1.14.18
release-1.14.19
release-1.14.2
release-1.14.20
release-1.14.21
release-1.14.22
release-1.14.23
release-1.14.24
release-1.14.25
release-1.14.26
release-1.14.27
release-1.14.28
release-1.14.29
release-1.14.3
release-1.14.30
release-1.14.4
release-1.14.5
release-1.14.6
release-1.14.7
release-1.14.8
release-1.14.9
release-1.18.0
release-1.18.1
release-1.18.2
release-1.18.3
release-1.18.4
release-1.18.5
release-1.8.0
release-1.8.1
release-1.8.2
release-1.8.3
release-1.8.4
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55862.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "211946334456033658492862651651970173562",
"length": 1711
},
"id": "CVE-2026-55862-091e3b33",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4",
"target": {
"file": "ixml/src/ixml.c",
"function": "ixmlPrintDomTreeRecursive"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"193895745126509563496018345717945522787",
"23979163397344759409813474972733305819",
"265815002633759192136530633525327972022",
"8543995547783232487357703608362198645"
],
"threshold": 0.9
},
"id": "CVE-2026-55862-2f0dd47b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/2719398035952dadb8e2970d27573707c28ba956",
"target": {
"file": "ixml/test/poc_ghsa_j247_getbytagname.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "138018983276273041362208914799767045463",
"length": 173
},
"id": "CVE-2026-55862-381bed23",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4",
"target": {
"file": "ixml/src/node.c",
"function": "ixmlNode_setSiblingNodesParent"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "184806052561666729923138132388812111509",
"length": 397
},
"id": "CVE-2026-55862-5fba310f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4",
"target": {
"file": "ixml/src/node.c",
"function": "ixmlNode_getElementsByTagNameRecursive"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"132357575323654003245850903739329477963",
"218200307236698373126329546126526502578",
"315992081127165374219678938306725966443",
"190622255361933487116210240219973959716",
"37341094151962286381759904266270357054",
"20933267598993476538254548908394908811",
"264037111380627363807594238238433441309",
"250763519572662868691708256057145938983",
"88402134270435106278561611301082272774",
"48913545368281612482186294782290921542",
"301717011270467857888854299593245034290",
"127594296009944537444035099240642130113",
"142619127209431725431938501521324606520",
"85079182925221439165033332930263743900",
"336563039368157343466365384127015525879",
"113477148231037387953701751627784207184",
"96878145645653072804353687216811298463",
"79922018612622351768494268107899019329",
"231867751294973409721054282255552983630",
"324556018277494644137199021023180285155",
"233944880805808720969821506369306649358",
"40074114816550407254500679976009633941",
"99661739405037196668876570306229628230",
"45358316308923838142456996700785139890",
"193204186679234423291235852263834261368",
"196843394682966666582878674639076811516",
"166775597120406158500860270680250344086",
"316829848144361805782824884424229931764",
"82790090270986278553720888589172828702",
"273703525215948783022971217807130447353",
"333649432560911724121214178798063508937",
"36520282080710867232254053941834530701",
"4046379174864301437934478260134420918",
"295340384086694549294453275362778070368",
"280592415237772433437877720271859083958",
"172703623571410188331310201301985683321",
"287951670906168014815480457792966097504",
"174043734576028828834051371332091947325",
"7950904237888409501280918438017008054",
"22946858307862646752851879346368557033",
"110028482587566587478056405413380289925",
"309658900123307938136110291756287423899",
"31609976666253313959146890729342652839",
"197790924126144139125960218741481489612",
"36072711505839558958709049685248063126",
"137779418519903902476737317963181586707",
"67974855583708984129109606419853168494",
"214884475070816429838958651963214799953",
"273901693126478525474849962468463626559",
"108562233078326028340316069227269434363",
"142700564774965253007551111132164067925",
"81724883966568307898773417910688635910",
"104988692749276090507484085978294995221",
"248193150859182523771660444653129342071",
"94565632594914265396885805338675176198",
"219377997777384975997326191829201691021",
"211263043381343166734047865722042436926",
"211179382800600963893414486048268364736",
"84001164077566047812879063614627063391",
"158607253377716733588802471496151414281",
"190186636396351316245032277421380104247",
"181285193886866933437720449364790503496",
"282561224085897988696257728124956142161",
"4781334524318323226487232031192152624",
"36279832493816547916362999016453924972",
"218407318080766292868289140070180108857",
"185093636926918171252468362895848992090",
"311363030691124712355683986383081605402",
"39214821313045194329313806410405710319",
"116486318558515193827245010972995203894",
"7819586464810873134160356450048764793",
"311790322342548446246278949658535922547",
"143254601617816395166201093324262267359",
"84896375592709035627919626798686949725",
"8976899399710676714091014671157520699",
"129819916217147486954866510255449184822",
"183717950691583011874231633745449812967",
"170862054098401861053233257217498384810",
"323537329544907064059329600200921187282",
"86195463482013339469368308706992309968",
"62392838845776459924183617071134357332",
"188243545740793816753953091886965350401",
"73256505663907983688237441111411416681",
"3375203696208005377134719206654193861",
"47304188870752371599919263558792561340",
"97582549879822325594195775989887465510",
"48619892301090210296893608859075831719",
"122776097656094512862910281225540063641",
"279244254662684036791244659880624306576",
"108795630359520518504001831458480845520",
"181842545565008780825668148145542727878",
"99508072059761799784483155007079729149",
"240909339897291986831788258285711496618",
"80029140577372463257882266355820467081",
"261460234569281281483570879471977386521",
"281387987112796497181262160790616176405",
"127346316412537515339075671595619669353",
"170151034489255439685601543124476129696",
"231646580073435364735878869348503710646",
"271649626070877174113333155860358497797",
"34685645745134891373693030315274849239",
"143558996672731473170688121133094742047",
"274557158053677818995938735137913658228",
"25285907891420258569773423400519362398",
"67638507263105117151053367492904378208",
"339650703760097629213517581058201377009",
"61709924152957560838176499216331571884",
"292757855412493363975852572874684446842",
"119057032226874960290683986047730095370",
"25469075671445287816579674705687137210",
"66268761069914527624242236439385436116",
"247113472412066594330459163528650807824",
"327455705510032695952603476195352156933",
"103808051946386404910771820182962534225",
"63478861441260205356018612697990657698",
"330934609135983420043642880538555665477",
"38358436315211688005328653314032241708",
"175525507374947159608858781855276302326",
"252646373858477426157911265682674834933",
"171078509221816925934045914976083422131",
"224283889039430118926949756660600156357",
"185328811540095911694003106562785464613",
"268419412284856022055906942155608893379",
"262781001331399470680942421462326314830",
"146611484064500858102653751156057617764",
"249550797900724467979561341658540741610",
"271862104406566905247456548373028152908",
"79021521509539085633319893647806919473",
"288447962443925962524839321049068418751",
"22572572732168207334249985531263414653",
"126560213782357711180196588424264528020",
"35215593988240182220189687073172665284",
"202734222375634109615869443911774158838",
"207680116938242095740710645420435974145",
"116120567737192873999217629253626725495",
"321714521197695164421047942733357727196",
"53959682604145245975254326586367009680",
"62087716826132861025683757609929309641",
"40271638887932681388645554497427047311",
"290766742913427299201087141910370819077",
"301807333935823758338834979696205002560",
"26565206274162851205600253171014252639",
"286561406826797386255404562112465417307",
"271026603992658208231571713181409682288",
"111699300558858853103562323785267319068",
"302988066401628951797232724598888754440",
"256385763120176366551455356579215148488",
"42786212899672927727640866402963222763",
"209476457085660976085412358273238068795",
"315094091748213186568488890891274411624",
"204665120094885818206166761574804294068",
"245755513318002539945475276940936146185",
"161504763841382850732946522292582463307",
"131804246305214101241493650328307981098",
"307010707241092682114319087581058031452",
"265183448797459962152536770332495408646",
"204699432951611592804159462078971923160",
"338944859789047733063280047230247866898",
"312082807022333434773842475165489802419",
"201108715123458937889263082741614412189",
"51545146700568231680023487152923766293",
"180103271543081585316720985440918779537",
"71281575826065353648831000428998217126"
],
"threshold": 0.9
},
"id": "CVE-2026-55862-6ac0edc6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4",
"target": {
"file": "ixml/src/node.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"282624158091868023947781663337824675498",
"326078742267480361688846221354046995420",
"96270560758243928063317952617018108581",
"243558053402847359523054475601193173959",
"168161154526523510157088121592358886968"
],
"threshold": 0.9
},
"id": "CVE-2026-55862-76e8b336",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/2719398035952dadb8e2970d27573707c28ba956",
"target": {
"file": "ixml/test/poc_ghsa_j247_getbytagnamens.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "253873830951614425591704152934702402453",
"length": 293
},
"id": "CVE-2026-55862-7b922991",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4",
"target": {
"file": "ixml/src/node.c",
"function": "ixmlNode_isAncestor"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"59666621926447470361516431799885902082",
"143143668864498987896124833488347687655",
"29795148230906091527448199524314389870",
"315610304853179134590603219187807801223",
"310013513396460873050000978334470174130",
"236021343818564818271288874717599815503",
"293189600821565471646599308046670175196"
],
"threshold": 0.9
},
"id": "CVE-2026-55862-8cd1afe5",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/2719398035952dadb8e2970d27573707c28ba956",
"target": {
"file": "ixml/src/node.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"190468276872408783487647911175413637561",
"146134622580568470218261892656164203661",
"37211938081275402767930754334128086814",
"252314851053355375432969809309292381080",
"235688505762017478724230833420912658799",
"304937789705398506911528249439084294680",
"72453708099957235455484912297645023319",
"312650986965317627864634615943865324158",
"205176692694222322707671719047503103281",
"237246098824634869904513721865194714377",
"177595181459115328534245654344414898947",
"136396967425835758238901851508103769091",
"16145416342202786923433734257203547942",
"335185335513882548286643686275713590364",
"141937355582933347300365587809555962192",
"231431708798829991714423294256538432492",
"203382972070368134422661788485171341629",
"283418904080340631487409171587787429493",
"14929550505600051078257317000725121031",
"134850134343494053646904117084924162297",
"205310824346319390194667171961679976522",
"177189765496540778270288999024742545662",
"316207883247851136583385094680451390675",
"205770170029043717227021525654049919528",
"149386041930775318991253087118569129767",
"43180294259904488868385700427986206767",
"3899017499626138567580867825316582479",
"124577860249899223685208673542021203386",
"85912938070106171339114300356946386528",
"121845348461128574411013430729619451565",
"255315704672919783737027466143916041210",
"68632368566850351782850217376398941503",
"207394877079604295013720181923625645347",
"95462719092553485402362693250489546248",
"317958248779449041273722114466588210812",
"104827019030306911680218791102132765869",
"59473005665817455317597430923688484891",
"119481404332883874880273729992437956285",
"20258684293361817067346931889884541492",
"265629212497582677718137056065975482972",
"34070007855927385928693557130926008266",
"189586235985229977540363183736402518347",
"641434129963038684410229784018855119",
"238233700681799813650571541447491323214",
"211195162266254387552881355502351416479",
"211656077616090852767633993236818767623",
"255195580253367612980692634628425923479",
"312089577975330426924686002789522038901",
"67798366432860299308782905238359465678",
"48302953164563330509847885741586016381",
"169528678894836463448890393059969212527",
"138263424823875130286231515016709182555",
"196290000655187170329591827793074496106",
"116698880440034050558932788320738755450",
"44093774006341579545366761149866709143",
"314959026207680687754003044480802941449",
"123772398787121524688313227707109320828",
"119577312167414660662886257579364282129",
"102665663695090706310877941388728505173",
"144273767566516477167886853099661405917",
"302920063754093978189832112221639778100",
"227586564491094783360919978826874643182",
"143049739172475740200205538307478574929",
"133938610014475324460093486733270370848",
"150790129488062555867985830187195556822",
"255964004385330486511660797414133807543",
"205458407997705503085634790334821763680",
"231883071030547053956622134202434693937",
"44230819142340695348351666186149284394",
"335944901777864142808066240959345582547",
"69726491832001972419155196564715801616",
"217466768043829834463136324664690293084",
"198767970582789191697860798211980360656",
"121824527697473545117843056778941511600",
"306740547721114111729713118851289393345",
"334156502919208607964837222828016195746",
"14413136371454879967055493826271615239",
"307462120118072852273274667670935950853",
"75407180318704451699303769443305508093",
"35455453579016494056404142694951277667"
],
"threshold": 0.9
},
"id": "CVE-2026-55862-8f6b2444",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4",
"target": {
"file": "ixml/src/ixml.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "236688841960806477259754726771224815991",
"length": 1659
},
"id": "CVE-2026-55862-cc46fde1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4",
"target": {
"file": "ixml/src/node.c",
"function": "ixmlNode_cloneNodeTreeRecursive"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "166992179828289330618872843411920514867",
"length": 566
},
"id": "CVE-2026-55862-d3e232a1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4",
"target": {
"file": "ixml/src/node.c",
"function": "ixmlNode_getElementsByTagNameNSRecursive"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"267191095647575414181307899471529020341",
"182226675281168977511972045185047661236",
"258262646912937365928463993502768334592",
"128807550452034037471490368055091012015",
"112205841539857119113501375886180284073",
"315374281541895544550432497086769028887",
"304147030872915495310863656313578009691",
"298018651488612409280833481397733941839",
"179936436522533758915753165997753967056",
"10464635734180178550761000930718114544",
"205418999986972212666070503041003242044",
"320540182042322001193589514412717489750",
"108163243284010933973288116032185557530",
"299883647279344081284950203750792475055",
"208326865085338125225142143204880137522",
"181826264544600190713092513111165442337"
],
"threshold": 0.9
},
"id": "CVE-2026-55862-efcd52ff",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/pupnp/pupnp/commit/2719398035952dadb8e2970d27573707c28ba956",
"target": {
"file": "ixml/src/ixml.c"
}
}
]
vanir_signatures_modified
"2026-10-28T11:15:07Z"