{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"pupnp","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NT0R96PQ7T6ZPJ87KF2KWK","modified_at":"2026-10-24T09:47:32.189329018Z","published_at":"2026-10-16T16:18:44.060Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-55862","https://security-tracker.debian.org/tracker/CVE-2026-55862"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-55862","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-55862"}],"summary":"pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. The iterative X"}