CVE-2026-57487

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-57487

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57487.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-57487

Aliases

GHSA-gcj7-j9f7-q84c

Downstream

Published

2026-10-16T15:33:56Z

Modified

2026-10-28T10:57:56Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered

Details

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57487.json"
}

References

Affected packages

Git / github.com/pupnp/pupnp

Affected ranges

Type

GIT

Repo

https://github.com/pupnp/pupnp

Events

Introduced

Fixed

280cff736ee0a2384d8a67011382e6fe76a51167

Fixed

9ff9bc583ad8ee4ba022634434a7b71db9bd96e1

Database specific

Show details

{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:pupnp_project:pupnp:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.0.2"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "9ff9bc583ad8ee4ba022634434a7b71db9bd96e1"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "release-2.0.2",
            "range": [
                {
                    "fixed": "280cff736ee0a2384d8a67011382e6fe76a51167"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other

last_svn_trunk

release-1.*

release-1.10.0

release-1.10.1

release-1.12.0

release-1.14.0

release-1.14.1

release-1.14.10

release-1.14.11

release-1.14.12

release-1.14.13

release-1.14.14

release-1.14.15

release-1.14.16

release-1.14.17

release-1.14.18

release-1.14.19

release-1.14.2

release-1.14.20

release-1.14.21

release-1.14.22

release-1.14.23

release-1.14.24

release-1.14.25

release-1.14.26

release-1.14.27

release-1.14.28

release-1.14.29

release-1.14.3

release-1.14.30

release-1.14.4

release-1.14.5

release-1.14.6

release-1.14.7

release-1.14.8

release-1.14.9

release-1.18.0

release-1.18.1

release-1.18.2

release-1.18.3

release-1.18.4

release-1.18.5

release-1.8.0

release-1.8.1

release-1.8.2

release-1.8.3

release-1.8.4

release-2.*

release-2.0.0

release-2.0.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57487.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "177585882812332995847826067376108193915",
                "39571349669158898400279135012346916366",
                "199265452873473304394132749040208566492",
                "277167506477902088703027147042000213917",
                "311417204019414394119153942625632943405",
                "148198131498251095742366426191290258174",
                "170987491729861659404744459601803007714",
                "209615811826478195855043111705915663467",
                "222802971839295809261878213594560287448",
                "323195415889768237784272892189695891515",
                "277167506477902088703027147042000213917",
                "311417204019414394119153942625632943405",
                "148198131498251095742366426191290258174"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-57487-13358177",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/pupnp/pupnp/commit/9ff9bc583ad8ee4ba022634434a7b71db9bd96e1",
        "target": {
            "file": "upnp/src/genlib/net/http/httpreadwrite.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "82142552002294969475427263921626102286",
            "length": 2359
        },
        "id": "CVE-2026-57487-19c8e3e6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/pupnp/pupnp/commit/9ff9bc583ad8ee4ba022634434a7b71db9bd96e1",
        "target": {
            "file": "upnp/src/genlib/net/http/httpreadwrite.c",
            "function": "http_RecvMessage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "52107601416279361396342264133200996176",
            "length": 476
        },
        "id": "CVE-2026-57487-69243614",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/pupnp/pupnp/commit/280cff736ee0a2384d8a67011382e6fe76a51167",
        "target": {
            "file": "ixml/test/poc_ghsa_q54q.c",
            "function": "main"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "334027813865936129438216410789017650661",
                "54295986294101972822852762588617473092",
                "55486358970535260111721862803837298368",
                "479395375871184399048480116120362544"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-57487-faedecba",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/pupnp/pupnp/commit/280cff736ee0a2384d8a67011382e6fe76a51167",
        "target": {
            "file": "ixml/test/poc_ghsa_q54q.c"
        }
    }
]

vanir_signatures_modified

"2026-10-28T10:57:56Z"