UPnP SDK Vulnerability in pupnp Affects Device Applications

CVE-2026-55862

What is CVE-2026-55862?

The pupnp SDK, designed for the development of UPnP device and control point applications, contains a vulnerability affecting various functions that process deeply nested XML documents. This issue arises from unbounded recursion in multiple traversal functions, enabling an unauthenticated peer on the local network to send a SOAP request with complex XML structures. When such a malicious request is executed, it risks exhausting the service thread's stack, ultimately leading to a crash of the UPnP service. This vulnerability is an incomplete fix to a previous issue addressed in CVE-2021-28302. The problem is resolved in version 2.0.0, which mitigates the risks associated with these recursive processing paths.

References