CVE-2026-5720

Critical · CVSS 9.1

miniupnpd — Integer underflow out-of-bounds read (CWE-125, CWE-191) in SOAPAction HTTP header parsing leading to denial of service or information disclosure

CVSS: 9.1; nvd
EPSS: 0.67%; 48th pct
KEV: No
Class: other; CWE-125, CWE-191

Description

miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.

Search profile — drives PoC discovery

Symbols ParseHttpHeadersSOAPActionmemchrsingle quotelength underflowHTTP request bufferminiupnpd

Keywords CVE-2026-5720miniupnpdminiupnpSOAPActioninteger underflowParseHttpHeadersout-of-bounds readSOAP header parsingmemchrUPnP denial of servicef56bd09b2f2650126b832c5f30a65a09e28167fa

Versions: Versions prior to commit f56bd09b2f2650126b832c5f30a65a09e28167fa

References

Status: enriched · ingested 2026-06-29T18:00:49.000Z · profiled 2026-07-01T18:30:14.000Z