pupnp CVE-2026-57487

Exploitable when the pupnp process handles an HTTP message with Transfer-Encoding: chunked on any of the SOAP, GENA, miniserver, or control-point response paths in http_RecvMessage - i.e. default-enabled functionality, not a special configuration. The decoded chunked body is accumulated in parser->msg.entity without enforcing g_maxContentLength, so an attacker simply needs network reachability to the service and the ability to send chunked-encoded data. Limiting factors: the target must run a pupnp version prior to 2.0.2 and expose a reachable UPnP HTTP endpoint (often LAN-scoped on embedded devices, which constrains exposure to the local network segment unless the service is intentionally internet-facing); impact is confined to availability with no auth bypass or code execution.

All signals point to a genuine but impact-limited issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is confirmed and credible: a remote, unauthenticated peer can reach the vulnerable HTTP response paths with low complexity and no user interaction, and the source-code diff corroborates the root cause (the g_maxContentLength guard in http_RecvMessage only checked parser->content_length, not the accumulated parser->msg.entity.length for chunked bodies). However, impact is strictly availability (C:N/I:N/A:H, CWE-770 resource exhaustion) - there is no code execution or data exposure, so the 7.5 'High' reflects a pure DoS ceiling, not a critical compromise. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization; the vulnerability was reported through a coordinated GitHub Security Advisory (GHSA-gcj7-j9f7-q84c) with a fix already shipped in 2.0.2. Net priority: patch promptly on internet-reachable or multi-tenant UPnP services because exploitation is cheap and unauthenticated, but this is not a high-urgency RCE - the realistic worst case is a crashed or memory-starved UPnP process.

A remote attacker who can reach a pupnp-based service's HTTP endpoint (SOAP action, GENA subscription/notify, miniserver, or control-point response path) sends a request or response using Transfer-Encoding: chunked with a very large decoded body. Because the chunked path never updates content_length, the pre-2.0.2 size check is bypassed and the process buffers an entity far exceeding g_maxContentLength, exhausting memory and denying service. No public exploit code was identified at time of analysis, and no authentication or user interaction is required.