CVE-2026-77630: pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parsehostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parseuri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by createurllist in upnp/src/gena/genadevice.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pupnpto a version that resolves this vulnerability.Fixed in 22.0.4
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
UPnP device and control point applications built with pupnp versions before 22.0.4 are affected when they process inbound HTTP request targets or GENA SUBSCRIBE CALLBACK headers containing attacker-controlled hostnames.
What does an attacker need to exploit this issue?
An attacker needs only network access to send crafted requests; no authentication or user interaction is required. They can supply a slow or nonresponsive hostname that causes synchronous DNS resolution to block a miniserver worker.
How does this lead to service disruption?
Each malicious hostname can occupy a bounded miniserver worker until the DNS resolver times out. A small number of such requests can exhaust the thread pool and prevent UPnP service from being handled.
What is the available fix?
Upgrade pupnp to version 22.0.4, which fixes the issue.