diff --git a/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-5720.patch b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-5720.patch
new file mode 100644
index 0000000000..902e8321a5
--- /dev/null
+++ b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-5720.patch
@@ -0,0 +1,35 @@
+From d1c82ab65fd685ceed28a1a0de29510df7c3c959 Mon Sep 17 00:00:00 2001
+From: Thomas Bernard <miniupnp@free.fr>
+Date: Mon, 23 Mar 2026 02:37:02 +0100
+Subject: [PATCH] upnphttp.c: fix removal of quotes in ParseHttpHeaders()
+
+the length of the string including the quotes must be at
+least 2 for the string to contain the 2 enclosing quotes !
+
+(cherry picked from commit f56bd09b2f2650126b832c5f30a65a09e28167fa)
+
+CVE: CVE-2026-5720
+Upstream-Status: Backport [https://github.com/miniupnp/miniupnp/commit/f56bd09b2f2650126b832c5f30a65a09e28167fa]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ upnphttp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/upnphttp.c b/upnphttp.c
+index fc8ccb6..2d9a2a6 100644
+--- a/upnphttp.c
++++ b/upnphttp.c
+@@ -269,9 +269,10 @@ ParseHttpHeaders(struct upnphttp * h)
+ 					p++;
+ 				while(p[n]>=' ')
+ 					n++;
+-				if((p[0] == '"' && p[n-1] == '"')
+-				  || (p[0] == '\'' && p[n-1] == '\''))
++				if((n >= 2) && ((p[0] == '"' && p[n-1] == '"')
++				             || (p[0] == '\'' && p[n-1] == '\'')))
+ 				{
++					/* remove the quotes */
+ 					p++; n -= 2;
+ 				}
+ 				h->req_soapActionOff = p - h->req_buf;
diff --git a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.1.20191006.bb b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.1.20191006.bb
index b7ba37f290..0aadfe9cf6 100644
--- a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.1.20191006.bb
+++ b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.1.20191006.bb
@@ -14,6 +14,7 @@ DEPENDS += "iptables net-tools util-linux libmnl libnetfilter-conntrack openssl"
 SRC_URI = "http://miniupnp.tuxfamily.org/files/download.php?file=${BP}.tar.gz;downloadfilename=${BP}.tar.gz \
            file://miniupnpd.service \
            file://0001-Add-OpenEmbedded-cross-compile-case.patch \
+           file://CVE-2026-5720.patch \
            "
 SRC_URI[sha256sum] = "218fad7af31f3c22fb4c9db28a55a2a8b5067d41f5b38f52008a057a00d2206d"