6 results · Feed
-
High 7.5
pupnp: Denial of service via blocking DNS resolution in parse_uri()/GENA callback parsing
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request…
-
High 7.1
pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as un…
-
High 7.5
libupnp chunked HTTP bodies can bypass g_maxContentLength and be fully buffered
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP parser in upnp/src/genlib/net/http/httpparser.c to leave parser->content_length at zero while parser_parse_chunky_entity …
-
High 7.5
pupnp: NULL pointer dereference in ixmlNode_compare crashes on non-namespaced attributes
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created …
-
Medium 6.5
pupnp: Incomplete fix for CVE-2021-28302: recursive DOM functions cause stack overflow
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative XML parser accepts the document, but ixmlPrintDomTreeRecursi…
-
Medium 6.9
pupnp: Port truncation via atoi() cast in parse_uri() allows SSRF port confusion
pupnp is an SDK for development of UPnP device and control point applications. Prior to version 1.18.5, pupnp is vulnerable to SRRF port confusion due to port truncation via atoi() cast in parse_uri(). This issue has been patched in version 1.18.5.