pupnp EUVD-2026-102927

Exploitation requires network reachability to a pupnp (libupnp) UPnP service that accepts and parses SOAP requests, with the attacker positioned on the same local/adjacent network segment (AV:A) - no authentication or user interaction is needed against default configurations. The specific trigger is supplying XML nested deeply enough to drive the recursive ixml traversal functions (ixmlPrintDomTreeRecursive in ixml/src/ixml.c; ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, ixmlNode_isAncestor in ixml/src/node.c) into stack exhaustion. Limiting factors: the attacker must be on the local/adjacent network (not internet-routable by default), the impact is confined to crashing a service thread (availability only, no code execution or data exposure), and hosts running pupnp 2.0.0 or later are not affected.

This is a moderate-severity denial-of-service issue (CVSS 6.5, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) whose only impact is availability - a crashed UPnP service thread - with no confidentiality or integrity consequence (C:N/I:N). The CVSS signals are internally consistent and align with the description: AV:A matches the stated 'unauthenticated peer on the local network', PR:N matches 'unauthenticated', and A:H matches 'crash the UPnP service'. No EPSS score, KEV listing, or public exploit was provided in the input, so there is no evidence of active exploitation or widespread weaponization; this is a low-urgency issue by exploitation signals. The one aggravating factor is that it is an incomplete-fix case for CVE-2021-28302 (the 2021 remediation converted ixmlNode_free but left ixmlPrintDomTreeRecursive, ixmlNode_getElementsByTagNameRecursive/NSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor recursive), meaning the root CWE-674 class was known and previously under-remediated. The key limiter is the adjacent-network attack vector (AV:A): exploitation requires local/same-segment access, not internet reachability, so this is a priority primarily for environments where untrusted devices share the LAN (consumer, IoT, guest networks) rather than internet-facing exposure. Overall: a real but bounded issue - patch it, but it is not a high-CVSS, high-real-risk emergency.

An unauthenticated attacker on the same local network sends a crafted SOAP request containing XML nested thousands of levels deep to a device running a pupnp-based UPnP service. When the service parses and traverses the DOM (e.g., via ixmlPrintDomTreeRecursive or the getElementsByTagName traversal paths), the unbounded recursion over firstChild/nextSibling links exhausts the service thread's stack and crashes it. No public exploit code was identified in the input, though the fix commit publicly documents the vulnerable traversal paths.