CVE-2026-55862 pupnp CVE debrief

Who should care

Defenders responsible for UPnP services, network administrators, and developers using the pupnp SDK should assess exposure and apply the fix to prevent potential crashes and service disruptions.

Why it matters

Defenders should care about CVE-2026-55862 because it allows unauthenticated peers on the local network to potentially crash UPnP services using pupnp versions less than 2.0.0. The issue requires verification of exposure and application of the fixed version 2.0.0 to prevent service disruptions.

• Potential crashes of UPnP services due to stack overflow from deeply nested XML requests.
• Increased risk of service disruptions from unauthenticated network requests.
• Need for verification of pupnp version usage in UPnP services.
• Potential for increased network traffic and resource utilization due to malicious requests.

Technical summary

The pupnp SDK, used for UPnP device and control point applications, has an incomplete fix for CVE-2021-28302. Multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion, leading to a potential stack overflow. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhausting a service thread's stack and crashing the UPnP service. This issue is fixed in version 2.0.0 of pupnp.

Defensive priority

Defenders should prioritize verifying exposure of UPnP services using pupnp versions less than 2.0.0 and applying the fixed version 2.0.0 to prevent potential crashes from unauthenticated network requests.

Recommended defensive actions

• Verify if UPnP services using pupnp versions less than 2.0.0 are exposed to untrusted networks.
• Apply the fixed version 2.0.0 of pupnp to prevent potential crashes.
• Monitor UPnP service logs for unusual traffic patterns or crashes.
• Consider implementing network restrictions to limit exposure of UPnP services.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the incomplete fix for CVE-2021-28302, the affected versions of pupnp, and the fixed version 2.0.0. However, there is limited information on actual exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.