---
id: CVE-2026-55862
title: 'libupnp: libupnp: Denial of Service via deeply nested XML (CVE-2026-55862)'
summary: >-
  A flaw was found in libupnp. Several Document Object Model (DOM) traversal
  functions process deeply nested XML structures using unbounded recursion. An
  unauthenticated attacker on the local network can exploit this flaw by sending
  a crafte…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-674
vendor: Red Hat
product: pupnp
affected:
  - pupnp < 2.0.0
published: '2026-10-16'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T09:31:45+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55862.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55862.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-55862'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-55862'
  - url: 'https://github.com/pupnp/pupnp/security/advisories/GHSA-25cx-xv8x-j247'
    label: 'https://github.com/pupnp/pupnp/security/advisories/GHSA-25cx-xv8x-j247'
  - url: >-
      https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4
    label: >-
      https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4
  - url: 'https://github.com/pupnp/pupnp/releases/tag/release-2.0.0'
    label: 'https://github.com/pupnp/pupnp/releases/tag/release-2.0.0'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - exploit-available
epss: 0.00465
epssPercentile: 0.40093
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T19:07:16.486742Z'
ingestedAt: '2026-10-16T17:24:46.753Z'
---

## Overview

A flaw was found in libupnp. Several Document Object Model (DOM) traversal functions process deeply nested XML structures using unbounded recursion. An unauthenticated attacker on the local network can exploit this flaw by sending a crafted SOAP request containing deeply nested XML, exhausting stack memory. This issue causes the UPnP service to crash, resulting in a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-55862.json)

**libupnp: libupnp: Denial of Service via deeply nested XML**. Released 2026-10-16, updated 2026-10-21.

Not affected:

- All currently supported Red Hat products

## Remediation

Refer to the advisory for fix availability.