CVE-2026-77630

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

• CWE-400

• https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2Patch
• https://github.com/pupnp/pupnp/releases/tag/release-22.0.4Release Notes
• https://github.com/pupnp/pupnp/security/advisories/GHSA-46ph-jff5-5h77Vendor Advisory
• https://issues.oss-fuzz.com/issues/531780528Issue Tracking

Published

Oct 16, 2026

Last Modified

Oct 20, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77616Semantic MediaWiki is a free, open-source extension to Media…6.1
• CVE-2026-77619Vector is a high-performance observability data pipeline. Fr…8.7
• CVE-2026-7762A heap-based buffer overflow vulnerability in the dot11ah.ko…9.8
• CVE-2026-77620Vector is a high-performance observability data pipeline. Fr…8.7
• CVE-2026-77621Vector is a high-performance observability data pipeline. Fr…9.3
• CVE-2026-7763A heap-based buffer overflow vulnerability in the morse.ko H…9.8
• CVE-2026-77633Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-77634CakePHP is a rapid development framework for PHP. Prior to v…8.2
• CVE-2026-77635CakePHP is a rapid development framework for PHP. Prior to v…9.2
• CVE-2026-77637Cloudreve is a self-hosted file management and sharing syste…3.8
• CVE-2026-77638Tor before 0.4.9.11 is prone to a race condition where in ju…9
• CVE-2026-77639Tor before 0.4.9.9 was prone to a compression bomb bypass wh…5.3