CVE-2026-5720

miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/miniupnp/miniupnp/	Product
https://github.com/miniupnp/miniupnp/commit/f56bd09b2f2650126b832c5f30a65a09e28167fa	Patch
https://www.vulncheck.com/advisories/miniupnpd-integer-underflow-soapaction-header-parsing	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:miniupnp_project:miniupnpd:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) miniupnpd contiene una vulnerabilidad de desbordamiento negativo de enteros en el análisis del encabezado SOAPAction que permite a atacantes remotos causar una denegación de servicio o revelación de información enviando un encabezado SOAPAction malformado con una comilla simple. Los atacantes pueden desencadenar una lectura de memoria fuera de límites explotando una validación de longitud incorrecta en ParseHttpHeaders(), donde la longitud analizada sufre un desbordamiento negativo a un valor sin signo grande cuando se pasa a memchr(), causando que el proceso escanee memoria mucho más allá del búfer de solicitud HTTP asignado.

Information

Published : 2026-04-17 22:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-5720

Mitre link : CVE-2026-5720

CVE.ORG link : CVE-2026-5720

JSON object : View

Products Affected

miniupnp_project

miniupnpd

CWE

CWE-125

Out-of-bounds Read

CWE-191

Integer Underflow (Wrap or Wraparound)

{"id": "CVE-2026-5720", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5720", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T14:51:38.349879Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "miniupnp project", "product": "miniupnpd", "versions": [{"status": "affected", "version": "0", "lessThan": "2.3.10", "versionType": "semver"}], "defaultStatus": "unknown"}]}], "published": "2026-04-17T22:16:33.803", "references": [{"url": "https://github.com/miniupnp/miniupnp/", "tags": ["Product"], "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/miniupnp/miniupnp/commit/f56bd09b2f2650126b832c5f30a65a09e28167fa", "tags": ["Patch"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/miniupnpd-integer-underflow-soapaction-header-parsing", "tags": ["Third Party Advisory", "VDB Entry"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer."}, {"lang": "es", "value": "miniupnpd contiene una vulnerabilidad de desbordamiento negativo de enteros en el an\u00e1lisis del encabezado SOAPAction que permite a atacantes remotos causar una denegaci\u00f3n de servicio o revelaci\u00f3n de informaci\u00f3n enviando un encabezado SOAPAction malformado con una comilla simple. Los atacantes pueden desencadenar una lectura de memoria fuera de l\u00edmites explotando una validaci\u00f3n de longitud incorrecta en ParseHttpHeaders(), donde la longitud analizada sufre un desbordamiento negativo a un valor sin signo grande cuando se pasa a memchr(), causando que el proceso escanee memoria mucho m\u00e1s all\u00e1 del b\u00fafer de solicitud HTTP asignado."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:miniupnp_project:miniupnpd:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98F2C3E8-230F-4C27-BE4F-81FECF35732A", "versionEndExcluding": "2.3.10"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}