CVE-2026-5720 is a critical (CVSS 9.1) integer underflow in the SOAPAction header parser of miniupnpd. A malformed header can cause an out-of-bounds read, crashing the daemon or exposing memory. VulnCheck lists miniupnpd before 2.3.10 as affected, so upgrade. The record lists a network attack vector.
What's affected
VulnCheck's advisory says miniupnpd versions before 2.3.10 are affected. The record links to the upstream patch commit f56bd09b in the miniupnp repository. Confirm the fixed release against the project's changelog or your vendor's notes.
The cause is in ParseHttpHeaders. A parsed length underflows to a very large unsigned value when passed to memchr, so the program scans far beyond the allocated request buffer.
NVD scores this 9.1 with a network vector. VulnCheck scores it lower, with an adjacent network vector, which fits the fact that miniupnpd normally serves a local network behind a router.
How to check if you're exposed
miniupnpd usually runs inside routers and gateways, so the check is partly about devices.
- On Linux, find the version with your package manager. Many routers show it in a status page or firmware notes.
- Ask your router or gateway vendor whether firmware uses miniupnpd, and whether the fix is included.
- Check whether UPnP is enabled and reachable from anywhere other than your internal network.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Upgrade miniupnpd to 2.3.10 or later, or apply the upstream patch commit if you build it yourself.
- For routers and appliances, install the firmware update that includes the fix, and ask the vendor if none is listed.
- Turn UPnP off on devices that do not need it.
- Make sure UPnP is not reachable from the internet side of any gateway.
- Reboot or restart the daemon after updating.
Why it matters
The record lists CWE-191, integer underflow, and CWE-125, out-of-bounds read. A subtraction goes below zero in an unsigned value, which wraps to a huge number. When that number is used as a length, the program reads far past the buffer it was given.
The result described is a crash or a leak of memory contents. UPnP daemons run on many consumer and small office devices that rarely get updates, so the fix often arrives with firmware. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Why do NVD and VulnCheck score it differently?
NVD uses a network attack vector. VulnCheck lists an adjacent network vector, which reflects that the service normally listens on a local network.
Sources
Last reviewed: 19 October 2026.
