rootpwn

high · CVSS v3 7.5 · CVSS v4 8.7

CVE-2026-54571

ESPAsyncWebServer prior to version 3.11.1 contains a denial-of-service vulnerability in its multipart/form-data parser. An unauthenticated a

Overview

ESPAsyncWebServer prior to version 3.11.1 contains a denial-of-service vulnerability in its multipart/form-data parser. An unauthenticated attacker can send a crafted HTTP request with a 256-byte boundary to trigger an integer wrap-around condition. This results in an infinite loop that consumes excessive CPU resources and forces a watchdog reset on microcontrollers.

Description

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. This issue is fixed in version 3.11.1.

Impact

The vulnerability directly impacts availability by causing system reboots and service disruptions on vulnerable embedded devices. Confidentiality and integrity are not affected, but the continuous resetting prevents legitimate users from accessing the web or WebSocket server. IoT device administrators and embedded systems engineers managing connected microcontrollers are affected.

Remediation

Update the ESPAsyncWebServer library to version 3.11.1 or later where the boundary position storage variable has been corrected. If updating immediately is not possible, restrict network access to the web server interface using firewalls or network segmentation, and consider implementing input validation filters at a reverse proxy if applicable.

Risk context

The vulnerability carries a CVSS v4 score of 8.7 and a CVSS v3 score of 7.5, classifying it as high severity due to the ease of remote denial of service against exposed embedded systems. EPSS data is currently unavailable, but defenders should prioritize patching given the public nature of the flaw and the critical impact on device uptime.

Affected products

  • ESPAsyncWebServer < 3.11.1
  • ESP32
  • ESP8266
  • RP2040
  • RP2350

Scores

Severity
high
CVSS v2
5
CVSS v3
7.5
CVSS v4
8.7
EPSS

Denial of Service Embedded Systems IoT ESP32 ESP8266 Integer Overflow HTTP Server

← All CVEs