CVE-2021-28302 Denial of service in n/a
A stack overflow in the pupnp library allows attackers to cause a denial of service via recursive node freeing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-28302?
CVE-2021-28302 is a high-severity denial of service vulnerability in n/a, published on 12 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A stack overflow in pupnp before version 1.14.5 can cause the denial of service through the Parser_parseDocument() function. ixmlNode_free() will release a child node recursively, which will consume stack space and lead to a crash.
Weakness: CWE-770
Which versions are affected by CVE-2021-28302?
It affects 1 product.
Products include Pupnp Project Pupnp.
How do I fix CVE-2021-28302?
No fix has been published for CVE-2021-28302 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-28302 being exploited?
There is no known exploitation of CVE-2021-28302 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-29462 DNS rebinding in pupnp
- CVE-2026-57486 pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
- CVE-2026-57487 libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
- CVE-2026-77630 pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
- CVE-2026-57488 pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
Sources
Also known as DEBIAN-CVE-2021-28302, GHSA-24m8-vm8v-rrfv, UBUNTU-CVE-2021-28302.