CVE-2026-57488pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
Updated under an hour ago ()
Does this affect you?
It affects pupnp. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser can accept a body length different from the declared value. A remote adjacent-network peer can use the resulting parser disagreement to leave bytes to be interpreted as another request in persistent or proxied contexts, or can make a worker wait for an extremely large body and cause denial of service. This issue is fixed in 2.0.2.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- Weakness (CWE)
- CWE-190, CWE-444
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 16, 2026
Affected products
pupnp pupnp pupnp:pupnp (from the name) | before 2.0.2 | CNA record |
References
- https://github.com/pupnp/pupnp/security/advisories/GHSA-g6c2-x4r9-352gx-refsource-confirm
- https://github.com/pupnp/pupnp/commit/de9602aef34ff722f3630d66c9be8eaa0aa9f012x-refsource-misc
- https://github.com/pupnp/pupnp/releases/tag/release-2.0.2x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.