CVE-2026-57487

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57487
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57487.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57487
Aliases
  • GHSA-gcj7-j9f7-q84c
Downstream
Published
2026-10-16T15:33:56Z
Modified
2026-10-17T07:06:51Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
Details

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57487.json"
}
References

Affected packages

Git / github.com/pupnp/pupnp

Affected ranges

Type
GIT
Repo
https://github.com/pupnp/pupnp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
280cff736ee0a2384d8a67011382e6fe76a51167
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.0.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
last_svn_trunk
release-1.*
release-1.10.0
release-1.10.1
release-1.12.0
release-1.14.0
release-1.14.1
release-1.14.10
release-1.14.11
release-1.14.12
release-1.14.13
release-1.14.14
release-1.14.15
release-1.14.16
release-1.14.17
release-1.14.18
release-1.14.19
release-1.14.2
release-1.14.20
release-1.14.21
release-1.14.22
release-1.14.23
release-1.14.24
release-1.14.25
release-1.14.26
release-1.14.27
release-1.14.28
release-1.14.29
release-1.14.3
release-1.14.30
release-1.14.4
release-1.14.5
release-1.14.6
release-1.14.7
release-1.14.8
release-1.14.9
release-1.18.0
release-1.18.1
release-1.18.2
release-1.18.3
release-1.18.4
release-1.18.5
release-1.8.0
release-1.8.1
release-1.8.2
release-1.8.3
release-1.8.4
release-2.*
release-2.0.0
release-2.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57487.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "52107601416279361396342264133200996176",
            "length":  476
        },
        "id":  "CVE-2026-57487-69243614",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pupnp/pupnp/commit/280cff736ee0a2384d8a67011382e6fe76a51167",
        "target":  {
            "file":  "ixml/test/poc_ghsa_q54q.c",
            "function":  "main"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "334027813865936129438216410789017650661",
                "54295986294101972822852762588617473092",
                "55486358970535260111721862803837298368",
                "479395375871184399048480116120362544"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-57487-faedecba",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pupnp/pupnp/commit/280cff736ee0a2384d8a67011382e6fe76a51167",
        "target":  {
            "file":  "ixml/test/poc_ghsa_q54q.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-17T07:06:51Z"