Vulnerability · Published Oct 16, 2026 · Assigned by GitHub_M

CVE-2026-77630pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing

High 7.5

In plain English

A high-severity uncontrolled resource consumption in pupnp from pupnp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 72.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	pupnp	no fix listed	DEBIAN-CVE-2026-77630
Debian:14	pupnp	1:22.1.8-2	DEBIAN-CVE-2026-77630
Ubuntu:24.04:LTS	pupnp	no fix listed	UBUNTU-CVE-2026-77630
Ubuntu:26.04:LTS	pupnp	no fix listed	UBUNTU-CVE-2026-77630
Ubuntu:26.10	pupnp	no fix listed	UBUNTU-CVE-2026-77630
Ubuntu:22.04:LTS	pupnp-1.8	no fix listed	UBUNTU-CVE-2026-77630

Affected products (as reported)

Vendor	Product	Versions
pupnp	pupnp	< 22.0.4

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/pupnp/pupnp/security/advisories/GHSA-46ph-jff5-5h77 x_refsource_CONFIRM
https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2 x_refsource_MISC
https://github.com/pupnp/pupnp/releases/tag/release-22.0.4 x_refsource_MISC
https://issues.oss-fuzz.com/issues/531780528 x_refsource_MISC