CVE-2026-5720 Details
Description
miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.
A denial-of-service and information disclosure vulnerability has been identified in the MiniUPnP daemon (miniupnpd) versions prior to 2.3.10. The issue arises from an integer underflow in the parsing of the SOAPAction header, which remote attackers can exploit by sending a malformed header containing a single quote. This exploitation triggers an out-of-bounds memory read by manipulating the length validation in the 'ParseHttpHeaders()' function. The underflow causes the length to be interpreted as a large unsigned value, leading the process to read memory far beyond the allocated buffer for the HTTP request.
Users can upgrade to MiniUPnP version 2.3.10 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| miniupnp project miniupnpd | < 2.3.10 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Modified Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | CVE Modified | [email protected] |
| Apr 20, 2026 | CVE Modified | [email protected] |
| Apr 17, 2026 | New CVE Received | [email protected] |