CVE-2026-5720: 
NixOS vulnerability analysis and mitigation

CVE-2026-5720 is an integer underflow vulnerability in miniupnpd's SOAPAction header parsing that allows remote attackers to cause denial of service or information disclosure. It affects miniupnpd versions prior to 2.3.10 and was disclosed on April 17, 2026, with a patch released in miniupnpd 2.3.10 (March 25, 2026). The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 7.1 (High) (Github Advisory, bugzilla.redhat.com).

The root cause is an integer underflow (CWE-191) combined with an out-of-bounds read (CWE-125) in the ParseHttpHeaders() function within miniupnpd/upnphttp.c. When a malformed SOAPAction header containing only a single quote character is received, the code attempts to strip enclosing quotes by decrementing the parsed length n by 2 without first verifying that n >= 2. This causes n to underflow to a very large unsigned integer value, which is then passed to memchr(), causing the process to scan memory far beyond the allocated HTTP request buffer. The fix, committed as f56bd09, adds a guard condition if(n >= 2) before the quote-stripping logic to prevent the underflow (github.com, Github Advisory).

Successful exploitation can result in denial of service through process crashes and information disclosure by leaking sensitive data from memory regions adjacent to the HTTP request buffer. Because the out-of-bounds read can expose arbitrary process memory, sensitive configuration data, credentials, or internal state held in memory could be disclosed to an unauthenticated attacker. No integrity impact has been identified, and exploitation does not require authentication or user interaction (Github Advisory, bugzilla.redhat.com).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.054% (17th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires adjacent network access (e.g., LAN or local network segment), which limits the attacker pool compared to fully internet-facing vulnerabilities (Github Advisory).

1. Reconnaissance: Identify hosts on the local network segment running miniupnpd (versions < 2.3.10) by scanning for the UPnP HTTP/SOAP service port (typically TCP 5000 or as configured), using tools such as nmap or UPnP discovery utilities.
2. Craft malicious HTTP request: Construct an HTTP POST request targeting the miniupnpd SOAP endpoint (e.g., /ctl/IPConn or similar UPnP control URL) with a SOAPAction header containing only a single quote character: SOAPAction: '.
3. Send the request: Transmit the crafted request from an adjacent network position to the miniupnpd service. No authentication is required.
4. Trigger integer underflow: The ParseHttpHeaders() function processes the single-quote SOAPAction value, attempts to strip enclosing quotes by computing n -= 2 without bounds checking, causing n to underflow to a large unsigned value.
5. Out-of-bounds memory read: The underflowed length is passed to memchr(), which scans far beyond the allocated HTTP request buffer, potentially crashing the process (DoS) or returning data from adjacent memory regions (information disclosure) (github.com, Github Advisory).

• Network: Unusual HTTP POST requests to miniupnpd SOAP control URLs with a SOAPAction header value consisting of a single quote (') or other minimal/malformed values; repeated connection attempts to the UPnP HTTP port from unexpected LAN hosts.
• Logs: miniupnpd syslog entries showing segmentation faults, abnormal process termination, or repeated restarts; HTTP access logs recording POST requests with anomalous SOAPAction header values.
• Process: Unexpected crashes or restarts of the miniupnpd process; core dump files generated in the miniupnpd working directory following a segmentation fault.

Upgrade miniupnpd to version 2.3.10 or later, which includes the fix for this vulnerability (commit f56bd09) (github.com, Github Advisory). As a workaround prior to patching, implement network segmentation to restrict access to the UPnP/SOAP service port to trusted LAN segments only, preventing untrusted adjacent-network hosts from sending crafted requests. Monitor miniupnpd for unexpected crashes or restarts that may indicate exploitation attempts.

Red Hat tracked the vulnerability via Bugzilla (Bug 2459328) and classified it as high severity, with the Red Hat Product Security team assigned to the issue (bugzilla.redhat.com). The vulnerability was assigned by VulnCheck and published to the GitHub Advisory Database on April 18, 2026. Coverage appeared in Linux-focused security news outlets including pro-linux.de, and the vulnerability was indexed by Tenable Nessus (plugin 307450) shortly after disclosure.