# CVE-2026-77630: pupnp UPnP SDK DNS resolution denial of service

Source: https://junglewise.ai/threats/cve-2026-77630-pupnp-is-an-sdk-for-development-of-upnp-device-and-control-point  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-77630 · Severity: high · CVSS 7.5 · Published 2026-10-16

pupnp is a software development kit for building UPnP device and control point applications, which enable networked devices to discover and communicate with each other. A remote attacker can send specially crafted network requests with slow or unresponsive hostnames to block worker threads in DNS resolution, exhausting the available thread pool and denying UPnP service to legitimate users.

Technologies: [Pupnp](https://junglewise.ai/threats/technologies/pupnp). Vendors: [Pupnp](https://junglewise.ai/threats/vendors/pupnp).

## Quick answers

**Is CVE-2026-77630 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77630 being exploited in the wild.

**How severe is CVE-2026-77630?** High severity, with a CVSS score of 7.5, published 16 October 2026.

**Which products and versions are affected?** Pupnp prior to 22.0.4.

**Is there a fix for CVE-2026-77630?** Yes: fixed in 22.0.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77630 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77630?** Check whether you run Pupnp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 22.0.4

## Technical details

The vulnerability exists in the parse_hostport and parse_uri functions, which perform synchronous DNS resolution (getaddrinfo) on untrusted hostnames supplied via HTTP request lines and GENA SUBSCRIBE callback headers. An unauthenticated remote attacker can exploit this by sending requests with slow-resolving hostnames, blocking bounded miniserver worker threads on the resolver timeout and exhausting the thread pool. The fix defers DNS resolution to legitimate outbound-connection points rather than performing it during URI parsing.

## Affected products

- pupnp pupnp prior to 22.0.4

## Timeline

- 2026-10-16: disclosed
- 2026-07-14: patched

## References

- [https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2](https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2)
- [https://github.com/pupnp/pupnp/releases/tag/release-22.0.4](https://github.com/pupnp/pupnp/releases/tag/release-22.0.4)

## Related threats

- [pupnp integer truncation in Content-Length parsing](https://junglewise.ai/threats/cve-2026-57488-pupnp-is-an-sdk-for-development-of-upnp-device-and-control-point)
- [pupnp HTTP parser denial of service via chunked Transfer-Encoding](https://junglewise.ai/threats/cve-2026-57487-pupnp-is-an-sdk-for-development-of-upnp-device-and-control-point)
- [pupnp NULL dereference in ixmlNode_compare](https://junglewise.ai/threats/cve-2026-57486-pupnp-is-an-sdk-for-development-of-upnp-device-and-control-point)
- [pupnp recursive XML parsing stack overflow](https://junglewise.ai/threats/cve-2026-55862-pupnp-is-an-sdk-for-development-of-upnp-device-and-control-point)