CVE-2026-5720 is an integer underflow vulnerability in the miniupnpd component of the miniupnp project. The issue occurs during parsing of the SOAPAction HTTP header, where a malformed header with a single quote causes the length value to underflow to a large unsigned integer. This incorrect length is then passed to memchr(), resulting in scanning memory beyond the allocated HTTP request buffer. This can lead to denial of service or information disclosure by reading out-of-bounds memory.

Exploitation of this vulnerability can cause the miniupnpd process to read memory beyond its allocated buffer, potentially exposing sensitive information or causing a denial of service due to memory access violations. The CVSS 4.0 score of 7.1 reflects a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor vendor communications for updates and consider mitigating exposure by restricting access to the miniupnpd service until a fix is available.