CVE-2026-57488
Description
A flaw was found in pupnp. An integer truncation vulnerability in the HTTP parser allows an adjacent network attacker to cause a Denial of Service (DoS). When processing the Content-Length header on 64-bit systems, large integer values can truncate or wrap, causing the parser to miscalculate the request body length. An attacker can exploit this flaw by sending a crafted request, causing worker processes to hang indefinitely waiting for an oversized payload or causing subsequent bytes to be misinterpreted as separate requests in persistent or proxied connections.
Statement
This vulnerability is rated as Important severity because an unauthenticated adjacent attacker can cause a denial of service by hanging worker processes or trigger request desynchronization across persistent HTTP connections. The pupnp library is not shipped or enabled by default in Red Hat Enterprise Linux. Consequently, standard Red Hat deployments are not exposed unless custom or third-party applications integrate and expose the vulnerable UPnP parser to adjacent network peers.
Understanding the Weakness (CWE)
Other,Integrity
Technical Impact: Unexpected State; Quality Degradation
The program could wind up using the wrong number and generate incorrect results. If the number is used to allocate resources or make a security decision, then this could introduce a vulnerability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
