CVE-2026-55862 in pupnp
Summary
by MITRE • 10/16/2026
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursive in ixml/src/ixml.c and ixmlNode_getElementsByTagNameRecursive, ixmlNode_getElementsByTagNameNSRecursive, ixmlNode_cloneNodeTreeRecursive, and ixmlNode_isAncestor in ixml/src/node.c recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service. This is an incomplete-fix case for CVE-2021-28302 because its remediation converted ixmlNode_free but left these traversal paths recursive. This issue is fixed in 2.0.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The Portable Universal Plug and Play library, commonly known as pupnp, serves as a foundational software development kit for building applications that utilize the UPnP protocol suite to enable device discovery and control on local networks. Within this ecosystem, the internal XML parsing component relies heavily on an iterative parser for general document acceptance but utilizes specific recursive functions for DOM traversal operations such as printing tree structures, retrieving elements by tag name or namespace, cloning node trees, and determining ancestor relationships. These critical functions are implemented in source files like ixml.c and node.c, where they traverse the XML structure by following firstChild and nextSibling pointers to navigate from parent nodes to their children and siblings respectively. This architectural choice introduces a significant security risk because these recursive calls do not implement any depth limiting mechanisms or stack size checks before proceeding with further traversal of nested elements.
This design flaw creates a classic stack-based buffer overflow scenario through unbounded recursion, which is formally categorized under CWE-675 as the use of externally controlled values in repetitive loops without adequate bounds checking. When an attacker supplies a maliciously crafted XML document featuring deeply nested structures via a SOAP request to a UPnP service endpoint, the recursive traversal functions will continue calling themselves for each level of nesting until the system's thread stack space is completely exhausted. Because these operations occur within dedicated service threads that handle incoming network requests, the resulting stack overflow causes an immediate crash or termination of the affected process. This behavior constitutes a Denial of Service vulnerability, aligning with MITRE ATT&CK technique T1498 which describes Network Denial of Service through resource exhaustion. The impact is particularly severe because it allows unauthenticated remote attackers on the local network segment to disrupt service availability without requiring any prior authentication credentials or user interaction.
The severity of this issue was compounded by its classification as an incomplete fix for CVE-2021-28302, indicating that previous remediation efforts had addressed other vectors such as memory freeing operations via ixmlNode_free but failed to sanitize the recursive traversal paths in node.c and ixml.c. This oversight allowed attackers to bypass earlier patches by targeting these specific DOM manipulation functions rather than the initial parsing stage. The vulnerability highlights a common pitfall in C/C++ development where recursion is used for tree structures without implementing safeguards against maliciously deep inputs, leading to predictable resource exhaustion attacks that can destabilize critical network infrastructure services.
To mitigate this risk and prevent similar vulnerabilities in future implementations, developers must enforce strict limits on XML parsing depth or refactor recursive algorithms into iterative equivalents using explicit stack data structures allocated on the heap rather than the call stack. Implementing input validation at the SOAP request entry point to reject documents exceeding a reasonable nesting threshold is also essential for defense-in-depth strategies. Organizations relying on pupnp versions prior to 2.0.0 should prioritize upgrading to the patched release which resolves these traversal issues by ensuring that all DOM operations are performed safely without risking stack overflow conditions. Additionally, deploying network segmentation policies can limit exposure to unauthenticated peers who might attempt to exploit this flaw over local area networks.