CVE-2026-55862

pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in ixml/src/node.c recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service. This is an incomplete-fix case for CVE-2021-28302 because its remediation converted ixmlNode_free but left these traversal paths recursive. This issue is fixed in 2.0.0.

• CWE-674

• https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4Patch
• https://github.com/pupnp/pupnp/releases/tag/release-2.0.0Release Notes
• https://github.com/pupnp/pupnp/security/advisories/GHSA-25cx-xv8x-j247Exploit, Mitigation, Vendor Advisory
• https://github.com/pupnp/pupnp/security/advisories/GHSA-25cx-xv8x-j247Exploit, Mitigation, Vendor Advisory

Published

Oct 16, 2026

Last Modified

Oct 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55856MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55857MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55858MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-55859MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL …5.9
• CVE-2026-5586A vulnerability was determined in zhongyu09 openchatbi up to…6.3
• CVE-2026-55860MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL …5.9
• CVE-2026-55863motionEye (mEye) is an online interface for a piece of softw…5.3
• CVE-2026-55864GeoNetwork is a catalog application to manage spatially refe…7.8
• CVE-2026-55865Python Liquid is a Python engine for the Liquid template lan…7.1
• CVE-2026-55866SpiceDB is an open source database system for creating and m…3.7
• CVE-2026-55867Graylog is a free and open log management platform. From 6.2…5.3
• CVE-2026-5587A vulnerability was identified in wbbeyourself MAC-SQL up to…6.3