CVE-2026-77630

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77630
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77630.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77630
Aliases
  • GHSA-46ph-jff5-5h77
Downstream
Published
2026-10-16T15:36:05Z
Modified
2026-10-17T07:07:10Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
Details

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-400"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77630.json"
}
References

Affected packages

Git / github.com/pupnp/pupnp

Affected ranges

Type
GIT
Repo
https://github.com/pupnp/pupnp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4145da68112f61660c8e55ed61fae1bb07d0e3d8
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "22.0.4"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
last_svn_trunk
release-1.*
release-1.10.0
release-1.10.1
release-1.12.0
release-1.14.0
release-1.14.1
release-1.14.10
release-1.14.11
release-1.14.12
release-1.14.13
release-1.14.14
release-1.14.15
release-1.14.16
release-1.14.17
release-1.14.18
release-1.14.19
release-1.14.2
release-1.14.20
release-1.14.21
release-1.14.22
release-1.14.23
release-1.14.24
release-1.14.25
release-1.14.26
release-1.14.27
release-1.14.28
release-1.14.29
release-1.14.3
release-1.14.30
release-1.14.4
release-1.14.5
release-1.14.6
release-1.14.7
release-1.14.8
release-1.14.9
release-1.18.0
release-1.18.1
release-1.18.2
release-1.18.3
release-1.18.4
release-1.18.5
release-1.8.0
release-1.8.1
release-1.8.2
release-1.8.3
release-1.8.4
release-2.*
release-2.0.0
release-2.0.1
release-2.0.2
release-22.*
release-22.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77630.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "323806000987652477654482293667370309651",
            "length":  529
        },
        "id":  "CVE-2026-77630-0a3a08a3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/pupnp/pupnp/commit/4145da68112f61660c8e55ed61fae1bb07d0e3d8",
        "target":  {
            "file":  "upnp/test/test_parse_uri.c",
            "function":  "main"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "175725553297300549292885301652570354265",
                "316523031587517889718646009359660650629",
                "242990382878904088188897092697476934680",
                "314702083531246807665780217813427262060",
                "146293774892874795700099845722697948268"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-77630-2b0efe08",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/pupnp/pupnp/commit/4145da68112f61660c8e55ed61fae1bb07d0e3d8",
        "target":  {
            "file":  "upnp/test/test_parse_uri.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-17T07:07:10Z"