PT-2026-33521 · Miniupnp · Miniupnpd

Kazuma Matsumoto · Published 2026-04-17 · Updated 2026-05-11 · CVE-2026-5720

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions miniupnpd (affected versions not specified)

Description An integer underflow exists in the parsing of the 'SOAPAction' header. Remote attackers can cause a denial of service or information disclosure by sending a malformed 'SOAPAction' header containing a single quote. This occurs due to improper length validation in the ParseHttpHeaders() function, where the parsed length underflows to a large unsigned value when passed to memchr(), leading to an out-of-bounds memory read as the process scans memory beyond the allocated HTTP request buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Integer Underflow

Out of bounds Read

Weakness Enumeration

CWE-191

CWE-125

Related Identifiers

CVE-2026-5720

Affected Products

Miniupnpd

References · 15

• https://github.com/miniupnp/miniupnp/commit/f56bd09b2f2650126b832c5f30a65a09e28167fa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5720 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-5720 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5720 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5720 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5720 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5720 · Vendor Advisory
• https://github.com/miniupnp/miniupnp/commit/a0ee71e9fa66b60052bb3d2cf84380b79db3f8c8 · Note
• https://github.com/miniupnp/miniupnp/commit/b5e5d2eb069822b7f00d56c8e61033b9d500e60c · Note
• https://github.com/miniupnp/miniupnp · Note
• https://vulncheck.com/advisories/miniupnpd-integer-underflow-soapaction-header-parsing · Note
• https://twitter.com/VulmonFeeds/status/2045378358221975800 · Twitter Post
• https://t.me/cveNotify/163087 · Telegram Post
• https://twitter.com/CVEnew/status/2045467377001742742 · Twitter Post
• https://t.me/cveNotify/162093 · Telegram Post