CVE-2026-55862

Name of the Vulnerable Software and Affected Versions pupnp versions prior to 2.0.0

Description Multiple ixml DOM traversal functions process deeply nested XML using unbounded recursion. While the iterative XML parser accepts the document, specific functions recurse over firstChild and nextSibling links. An unauthenticated peer on the local network can send deeply nested XML via a SOAP request to exhaust a service thread's stack, resulting in a crash of the UPnP service. The affected functions include ixmlPrintDomTreeRecursive() in ixml/src/ixml.c, as well as ixmlNode getElementsByTagNameRecursive(), ixmlNode getElementsByTagNameNSRecursive(), ixmlNode cloneNodeTreeRecursive(), and ixmlNode isAncestor() in ixml/src/node.c.

Recommendations Update to version 2.0.0.