CVE-2026-5720

Name of the Vulnerable Software and Affected Versions miniupnpd (affected versions not specified)

Description An integer underflow exists in the parsing of the 'SOAPAction' header. Remote attackers can cause a denial of service or information disclosure by sending a malformed 'SOAPAction' header containing a single quote. This occurs due to improper length validation in the ParseHttpHeaders() function, where the parsed length underflows to a large unsigned value when passed to memchr(), leading to an out-of-bounds memory read as the process scans memory beyond the allocated HTTP request buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.