pupnp up to 22.0.3 URI Parser uri.c parse_hostport improper synchronization

Summaryinfo

A vulnerability has been found in pupnp up to 22.0.3 and classified as problematic. This affects the function parse_hostport of the file upnp/src/genlib/net/uri/uri.c of the component URI Parser. The manipulation leads to improper synchronization. This vulnerability is traded as CVE-2026-77630. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in pupnp up to 22.0.3. This issue affects the function parse_hostport of the file upnp/src/genlib/net/uri/uri.c of the component URI Parser. The manipulation with an unknown input leads to a improper synchronization vulnerability. Using CWE to declare the problem leads to CWE-662. The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes. Impacted is availability. The summary by CVE is:

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-77630 since 08/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 22.0.4 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• pupnp

Version

• 22.0.0
• 22.0.1
• 22.0.2
• 22.0.3

Website

• Product: https://github.com/pupnp/pupnp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion