CVE-2026-77630

HIGH 7.5

pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

CWE	CWE-400
Vendor	pupnp
Product	pupnp
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for pupnp pupnp

Be the first to know when new high vulnerabilities affecting pupnp pupnp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

pupnp / pupnp

< 22.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/pupnp/pupnp/security/advisories/GHSA-46ph-jff5-5h77 github.com: https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2 github.com: https://github.com/pupnp/pupnp/releases/tag/release-22.0.4 issues.oss-fuzz.com: https://issues.oss-fuzz.com/issues/531780528