CVE-2026-57487: libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->contentlength at zero while parserparsechunkyentity and parserparsechunkybody accumulate decoded bytes in parser->msg.entity. The gmaxContentLength checks in httpRecvMessage in upnp/src/genlib/net/http/httpreadwrite.c therefore reject oversized numeric Content-Length bodies but do not enforce the same limit on decoded chunked bodies. A remote peer that can reach a SOAP, GENA, miniserver, or control-point HTTP response path can make the process buffer an entity larger than the configured maximum, causing resource exhaustion and denial of service. This issue is fixed in 2.0.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pupnpto a version that resolves this vulnerability.Fixed in 2.0.2
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Deployments using pupnp before 2.0.2 are exposed where a remote peer can reach a SOAP, GENA, miniserver, or control-point HTTP response path. The issue affects chunked HTTP request or response entities that are processed by those paths.
What does an attacker need to do to trigger the issue?
An attacker needs network reachability to a relevant HTTP path and must send an HTTP entity using Transfer-Encoding: chunked. No authentication or user interaction is required according to the supplied severity vector.
Does configuring g_maxContentLength prevent exploitation?
No. The configured limit is enforced for oversized numeric Content-Length bodies, but decoded chunked bodies can be accumulated while the parser content length remains zero, bypassing that check.
What is the remediation?
Upgrade pupnp to version 2.0.2, which fixes the issue. If an upgrade cannot be applied immediately, restrict untrusted peers from reaching SOAP, GENA, miniserver, and control-point HTTP response paths where possible.