Denial of Service Vulnerability in pupnp SDK for UPnP Device Applications

CVE-2026-77630

What is CVE-2026-77630?

The pupnp SDK, used for developing UPnP device and control point applications, contains a vulnerability that can lead to a denial of service. Specifically, a flaw in the handling of incoming HTTP request targets allows an unauthenticated remote peer to exploit the system by providing slow or unresponsive hostnames. This exploit ties up resources by blocking a worker thread until a timeout occurs, ultimately exhausting the thread pool and making UPnP services unavailable. This issue was addressed in version 22.0.4, which mitigates the potential for such resource exhaustion.

References