pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parsehostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parseuri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by createurllist in upnp/src/gena/genadevice.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNodecompare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocumentcreateAttribute legitimately leave those fields NULL. When ixmlElementremoveAttributeNode compares two distinct attribute objects with the same nodeName through findconditionnode, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.