CVE-2026-57487 libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
Remote attackers can cause resource exhaustion and denial of service by sending chunked HTTP bodies that bypass content length limits in the pupnp library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-57487?
CVE-2026-57487 is a high-severity denial of service vulnerability in pupnp, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity and parser_parse_chunky_body accumulate decoded bytes in parser->msg.entity. The g_maxContentLength checks in http_RecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.
Weakness: CWE-770
Which versions are affected by CVE-2026-57487?
It affects 1 product.
Products include Pupnp Project Pupnp.
How do I fix CVE-2026-57487?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-57487 being exploited?
There is no known exploitation of CVE-2026-57487 in the wild and no public exploit code.
Other vulnerabilities in pupnp
- CVE-2021-29462 DNS rebinding in pupnp
- CVE-2026-57486 pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
- CVE-2026-77630 pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
- CVE-2021-28302 Denial of service in n/a
- CVE-2026-57488 pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
Sources
Also known as DEBIAN-CVE-2026-57487, GHSA-gcj7-j9f7-q84c, UBUNTU-CVE-2026-57487.