CVE-2026-10069 Details

A resource exhaustion vulnerability has been identified in Shibby Tomato version 1.28, specifically within the MiniUPnPd daemon. This vulnerability allows for uncontrolled memory growth by exploiting the HTTP request buffering mechanism. The issue arises when the daemon processes incomplete HTTP headers or oversized POST requests with exaggerated Content-Length values, leading to excessive heap memory consumption. The vulnerability can be exploited remotely by an unauthenticated attacker who has access to the LAN-side UPnP HTTP control interface.

It is recommended to enforce strict maximum sizes for HTTP request headers and bodies before processing them. Incomplete headers that exceed a small threshold should be rejected, and accepted Content-Length values should be clamped to a conservative maximum. Additionally, buffered request memory should be freed or reclaimed aggressively on abnormal connection teardowns. Rate-limiting and capping concurrent control connections can also help reduce the impact of this vulnerability.