{"id":"CVE-2026-77630","summary":"pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing","details":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in upnp/src/genlib/net/http/httpparser.c and GENA SUBSCRIBE CALLBACK headers handled by create_url_list in upnp/src/gena/gena_device.c. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service. This issue is fixed in 22.0.4.","aliases":["GHSA-46ph-jff5-5h77"],"modified":"2026-10-17T07:07:10.107846649Z","published":"2026-10-16T15:36:05.117Z","database_specific":{"cwe_ids":["CWE-400"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77630.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77630.json"},{"type":"FIX","url":"https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2"},{"type":"WEB","url":"https://github.com/pupnp/pupnp/releases/tag/release-22.0.4"},{"type":"ADVISORY","url":"https://github.com/pupnp/pupnp/security/advisories/GHSA-46ph-jff5-5h77"},{"type":"WEB","url":"https://issues.oss-fuzz.com/issues/531780528"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77630"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/pupnp/pupnp","events":[{"introduced":"0"},{"fixed":"4145da68112f61660c8e55ed61fae1bb07d0e3d8"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"22.0.4"}],"source":"AFFECTED_FIELD"}}],"versions":["release-22.0.3","release-2.0.2","release-2.0.1","release-2.0.0","release-1.18.5","release-1.14.30","release-1.18.4","release-1.18.3","release-1.18.2","release-1.18.1","release-1.18.0","release-1.14.29","release-1.14.28","release-1.14.27","release-1.14.26","release-1.14.25","release-1.14.24","release-1.14.23","release-1.14.22","release-1.14.21","release-1.14.20","release-1.14.19","release-1.14.18","release-1.14.17","release-1.14.16","release-1.14.15","release-1.14.14","release-1.14.13","release-1.14.12","release-1.14.11","release-1.14.10","release-1.14.9","release-1.14.8","release-1.14.7","release-1.14.6","release-1.14.5","release-1.14.4","release-1.14.3","release-1.14.2","release-1.14.1","release-1.14.0","release-1.12.0","release-1.10.1","release-1.10.0","release-1.8.4","release-1.8.3","release-1.8.2","release-1.8.1","release-1.8.0","last_svn_trunk"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77630.json","vanir_signatures":[{"digest":{"length":529,"function_hash":"323806000987652477654482293667370309651"},"id":"CVE-2026-77630-0a3a08a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/pupnp/pupnp/commit/4145da68112f61660c8e55ed61fae1bb07d0e3d8","target":{"function":"main","file":"upnp/test/test_parse_uri.c"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/pupnp/pupnp/commit/4145da68112f61660c8e55ed61fae1bb07d0e3d8","target":{"file":"upnp/test/test_parse_uri.c"},"deprecated":false,"digest":{"line_hashes":["175725553297300549292885301652570354265","316523031587517889718646009359660650629","242990382878904088188897092697476934680","314702083531246807665780217813427262060","146293774892874795700099845722697948268"],"threshold":0.9},"id":"CVE-2026-77630-2b0efe08"}],"vanir_signatures_modified":"2026-10-17T07:07:10Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}