CVE-2026-55862: pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNodegetElementsByTagNameRecursive, ixmlNodegetElementsByTagNameNSRecursive, ixmlNodecloneNodeTreeRecursive, and ixmlNodeisAncestor in ixml/src/node.c recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service. This is an incomplete-fix case for CVE-2021-28302 because its remediation converted ixmlNodefree but left these traversal paths recursive. This issue is fixed in 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pupnpto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
UPnP services built with pupnp versions before 2.0.0 are affected when they accept SOAP requests from peers on the local network. An unauthenticated local-network peer can trigger the issue.
What does an attacker need to do to exploit it?
The attacker needs network access to the local network and must send a SOAP request containing deeply nested XML. No authentication or user interaction is required.
What is the operational impact of successful exploitation?
Deeply nested XML can exhaust the stack of a service thread through recursive ixml DOM traversal functions. This can crash the UPnP service; the provided information indicates no confidentiality or integrity impact.
What should be done if an immediate upgrade is not possible?
The provided data identifies upgrading to pupnp 2.0.0 as the fix. It does not provide a documented workaround or configuration mitigation.