FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

miniupnpd -- Integer underflow in SOAPAction header parsing

Affected packages
		miniupnpd	<	2.3.10,1

Details

VuXML ID	43dc274d-f74b-4420-8ef8-d2e108213002
Discovery	2026-04-17
Entry	2026-10-16

An integer underflow in the SOAPAction header parsing in ParseHttpHeaders() lets a remote attacker trigger an out-of-bounds read by sending a malformed SOAPAction header containing a single quote. This can crash miniupnpd or disclose memory beyond the HTTP request buffer.

References

CVE Name	CVE-2026-5720
URL	https://github.com/miniupnp/miniupnp/commit/f56bd09b2f2650126b832c5f30a65a09e28167fa
URL	https://www.vulncheck.com/advisories/miniupnpd-integer-underflow-soapaction-header-parsing