# CVE-2026-57487: pupnp HTTP parser denial of service via chunked Transfer-Encoding

Source: https://junglewise.ai/threats/cve-2026-57487-pupnp-is-an-sdk-for-development-of-upnp-device-and-control-point  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-57487 · Severity: high · CVSS 7.5 · Published 2026-10-16

pupnp is a development library for UPnP device applications used in networked devices and services. An attacker who can send specially crafted HTTP requests with chunked transfer encoding can bypass size limits in the HTTP parser, causing the process to exhaust memory and crash. This affects any UPnP device or control point using vulnerable versions.

Technologies: [Pupnp](https://junglewise.ai/threats/technologies/pupnp). Vendors: [Pupnp](https://junglewise.ai/threats/vendors/pupnp).

## Quick answers

**Is CVE-2026-57487 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57487 being exploited in the wild.

**How severe is CVE-2026-57487?** High severity, with a CVSS score of 7.5, published 16 October 2026.

**Which products and versions are affected?** Pupnp before 2.0.2.

**Is there a fix for CVE-2026-57487?** Yes: fixed in 2.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57487 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57487?** Check whether you run Pupnp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.0.2

## Technical details

The HTTP parser in httpparser.c fails to set parser->content_length for chunked Transfer-Encoding requests, allowing parser->msg.entity to accumulate decoded bytes without triggering the g_maxContentLength checks in http_RecvMessage. An attacker with network access to SOAP, GENA, miniserver, or control-point HTTP endpoints can send oversized chunked bodies that bypass the configured content length limit, exhausting buffer resources. The fix enforces g_maxContentLength on both numeric Content-Length and accumulated chunked entity sizes.

## Affected products

- pupnp pupnp before 2.0.2

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/pupnp/pupnp/commit/9ff9bc583ad8ee4ba022634434a7b71db9bd96e1](https://github.com/pupnp/pupnp/commit/9ff9bc583ad8ee4ba022634434a7b71db9bd96e1)
- [https://github.com/pupnp/pupnp/releases/tag/release-2.0.2](https://github.com/pupnp/pupnp/releases/tag/release-2.0.2)

## Related threats

- [pupnp UPnP SDK DNS resolution denial of service](https://junglewise.ai/threats/cve-2026-77630-pupnp-is-an-sdk-for-development-of-upnp-device-and-control-point)
- [pupnp integer truncation in Content-Length parsing](https://junglewise.ai/threats/cve-2026-57488-pupnp-is-an-sdk-for-development-of-upnp-device-and-control-point)
- [pupnp NULL dereference in ixmlNode_compare](https://junglewise.ai/threats/cve-2026-57486-pupnp-is-an-sdk-for-development-of-upnp-device-and-control-point)
- [pupnp recursive XML parsing stack overflow](https://junglewise.ai/threats/cve-2026-55862-pupnp-is-an-sdk-for-development-of-upnp-device-and-control-point)