CVE-2026-5720

Description

miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.

PUBLISHED Reserved 2026-04-06 | Published 2026-04-17 | Updated 2026-05-04 | Assigner VulnCheck

Problem types

CWE-191: Integer Underflow (Wrap or Wraparound)

CWE-125: Out-of-bounds Read

Product status

Credits

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc. finder

References

github.com/miniupnp/miniupnp/ product

github.com/...ommit/f56bd09b2f2650126b832c5f30a65a09e28167fa patch

www.vulncheck.com/...ger-underflow-soapaction-header-parsing third-party-advisory

cve.org (CVE-2026-5720)

nvd.nist.gov (CVE-2026-5720)

Download JSON