miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5f908cb040 advisory.


    2026/03/24:
      fix missing fclose and potential double free in option file parsing

    2026/03/23:
      upnphttp.c: fix removal of quotes in ParseHttpHeaders()       minixml.c: fix buffer read overflow

    2026/02/05:
      Rewrite permission line parser

    2025/05/26:
      Fix false negative filtered STUN CGNAT test result for         unsupported servers #825

    2025/05/24:
      Fix Mac OS X 10.9 build

    2025/05/15:
      build: teststun executable

    2025/04/28:
      pf: fix delete_pinhole for openbsd. Was broken since miniupnpd 2.3.7

    2025/04/26       Fix parsing of interfaces names starting with a digit       nftables: add counter for DNAT rule (ENABLE_NFT_RULE_COUNTER in config.h)       nftables: improve scripts to support already existing tables

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-2e8a8fd35b advisory.


    2026/03/24:
      fix missing fclose and potential double free in option file parsing

    2026/03/23:
      upnphttp.c: fix removal of quotes in ParseHttpHeaders()       minixml.c: fix buffer read overflow

    2026/02/05:
      Rewrite permission line parser

    2025/05/26:
      Fix false negative filtered STUN CGNAT test result for         unsupported servers #825

    2025/05/24:
      Fix Mac OS X 10.9 build

    2025/05/15:
      build: teststun executable

    2025/04/28:
      pf: fix delete_pinhole for openbsd. Was broken since miniupnpd 2.3.7

    2025/04/26       Fix parsing of interfaces names starting with a digit       nftables: add counter for DNAT rule (ENABLE_NFT_RULE_COUNTER in config.h)       nftables: improve scripts to support already existing tables

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f933979509 advisory.


    2026/03/24:
      fix missing fclose and potential double free in option file parsing

    2026/03/23:
      upnphttp.c: fix removal of quotes in ParseHttpHeaders()       minixml.c: fix buffer read overflow

    2026/02/05:
      Rewrite permission line parser

    2025/05/26:
      Fix false negative filtered STUN CGNAT test result for         unsupported servers #825

    2025/05/24:
      Fix Mac OS X 10.9 build

    2025/05/15:
      build: teststun executable

    2025/04/28:
      pf: fix delete_pinhole for openbsd. Was broken since miniupnpd 2.3.7

    2025/04/26       Fix parsing of interfaces names starting with a digit       nftables: add counter for DNAT rule (ENABLE_NFT_RULE_COUNTER in config.h)       nftables: improve scripts to support already existing tables

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - miniupnpd contains an integer underflow vulnerability in SOAPAction header parsing that allows remote     attackers to cause a denial of service or information disclosure by sending a malformed SOAPAction header     with a single quote. Attackers can trigger an out-of-bounds memory read by exploiting improper length     validation in ParseHttpHeaders(), where the parsed length underflows to a large unsigned value when passed     to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer.
    (CVE-2026-5720)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
311159	Fedora 43 : miniupnpd (2026-5f908cb040)	Nessus	Fedora Local Security Checks	high
311156	Fedora 42 : miniupnpd (2026-2e8a8fd35b)	Nessus	Fedora Local Security Checks	high
311103	Fedora 44 : miniupnpd (2026-f933979509)	Nessus	Fedora Local Security Checks	high
307450	Linux Distros Unpatched Vulnerability : CVE-2026-5720	Nessus	Misc.	high

Detections

Analytics

CVE-2026-5720

high

Tenable Plugins

high

high

high

high