Vulnerability · Published Apr 17, 2026 · Assigned by VulnCheck
CVE-2026-5720miniupnpd Integer Underflow SOAPAction Header Parsing
High 7.1
In plain English
A high-severity out-of-bounds read in miniupnpd from miniupnp project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.24 | miniupnpd | 2.3.10-r0 | ALPINE-CVE-2026-5720 |
| Debian:12 | miniupnpd | no fix listed | DEBIAN-CVE-2026-5720 |
| Debian:13 | miniupnpd | 2.3.9-2+deb13u1 | DEBIAN-CVE-2026-5720 |
| Debian:14 | miniupnpd | 2.3.10-1 | DEBIAN-CVE-2026-5720 |
| Ubuntu:25.10 | miniupnpd | no fix listed | UBUNTU-CVE-2026-5720 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| miniupnp project | miniupnpd | 0 – before 2.3.10 |
Weakness: CWE-191, CWE-125 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N